feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets

Fresh installs need nothing in .env. See PR description for the full feature.

frontend/src/services/setup.service.ts

@@ -0,0 +1,33 @@
+import { api } from '../config/api';
+
+export interface SetupStatus {
+  needsAdmin: boolean;
+  complete: boolean;
+}
+
+export interface SetupAdminUser {
+  id: number;
+  username: string;
+  email: string;
+  role: { name: string; displayName?: string };
+}
+
+export interface CreateInitialAdminInput {
+  token: string;
+  email: string;
+  password: string;
+}
+
+// First-run bootstrap. Public endpoints that self-close once an admin exists.
+export const setupService = {
+  async getSetupStatus(): Promise<SetupStatus> {
+    const response = await api.get<SetupStatus>('/setup/status');
+    return response.data;
+  },
+
+  async createInitialAdmin(input: CreateInitialAdminInput): Promise<{ user: SetupAdminUser }> {
+    // Admin JWT is returned as an HttpOnly cookie (mirrors login); body carries the user.
+    const response = await api.post<{ user: SetupAdminUser }>('/setup/admin', input);
+    return response.data;
+  },
+};