feat: first-run web installer with admin account creation

- Backend: app_settings table + users.is_admin flag (schema + migrate)
- POST /api/setup creates admin user, first workspace and marks installed
  (transactional, single-use, rate-limited); GET /api/setup/status
- Guard middleware: API answers 503 { setupRequired: true } until installed
- Frontend: /setup wizard (welcome, admin account, workspace), router guard
  redirects to installer when uninstalled, API interceptor handles 503
- Docs: installer covered in README, SETUP, HOSTING and ROADMAP

docs/SETUP.md

@@ -57,8 +57,10 @@ npm install
 npm run dev   # http://localhost:5173
 ```
 
-Open the frontend, **Register** the first user, create a workspace, invite teammates
-by email (they must register with the same email first).
+Open the frontend, where the **first-run web installer** (`/setup`) creates the admin
+account (`is_admin=true`) and the first workspace, then logs you in automatically.
+Further teammates **Register** themselves and are invited by email
+(they must register with the same email first).
 
 ## Troubleshooting