feat(setup): event-types step in first-run wizard + un-hardcode event type deps (#800)

Fresh installs can now shape the event-type catalog during the setup
wizard — rename, delete or replace the seeded defaults while nothing
references them. On existing installs system types stay protected.

- New wizard step between features and config: edit name/URL prefix,
  remove, or add types; defaults shown as recommendations
- setup_wizard_completed app setting (migration 161): seeded true when
  an admin already exists, false on fresh installs; POST /api/setup/
  complete (adminAuth) flips it when the wizard finishes
- deleteEventType: system types deletable only while the flag is unset;
  in-use check extended to quotes; per-type reminder template
  (event_reminder_<slug>) is deleted with the type
- reminder-template self-heal no longer resurrects templates for slugs
  removed from the catalog
- v1 API event creation validates event_type against the live catalog
  instead of a hardcoded whitelist (custom types were rejected; the
  never-seeded 'family' slug is no longer silently accepted)
- contract→event conversion resolves the event type via
  crm_default_event_type / resolveDefaultEventType instead of
  hardcoding 'wedding' (resolveDefaultEventType moved from quoteService
  to eventTypeService for reuse)

backend/src/services/setupService.js

@@ -20,6 +20,21 @@ const { formatBoolean } = require('../utils/dbCompat');
 // is permanently closed once setup is done — safe even on a public IP.
 const SETUP_TOKEN_KEY = 'setup_token';
 
+// One-way flag flipped when the setup wizard finishes (migration 161 marks it
+// completed on installs that predate the wizard's event-types step). While it
+// is unset — i.e. only during the first-run wizard — the seeded SYSTEM event
+// types may be deleted (eventTypeService.deleteEventType), because nothing
+// can reference them yet. Once true, system types are permanently protected.
+const SETUP_WIZARD_COMPLETED_KEY = 'setup_wizard_completed';
+
+async function isSetupWizardCompleted() {
+  return (await getAppSetting(SETUP_WIZARD_COMPLETED_KEY)) === true;
+}
+
+async function markSetupWizardCompleted() {
+  await upsertAppSetting(SETUP_WIZARD_COMPLETED_KEY, JSON.stringify(true), 'boolean');
+}
+
 async function noAdminExists() {
   const row = await db('admin_users').count({ c: '*' }).first();
   return Number(row?.c || 0) === 0;
@@ -173,4 +188,11 @@ async function createInitialAdmin({ token, email, password, ip }) {
   };
 }
 
-module.exports = { getSetupStatus, ensureSetupToken, verifySetupToken, createInitialAdmin };
+module.exports = {
+  getSetupStatus,
+  ensureSetupToken,
+  verifySetupToken,
+  createInitialAdmin,
+  isSetupWizardCompleted,
+  markSetupWizardCompleted,
+};