feat(setup): brand first-run screen and split into two-step wizard

Address post-merge UI feedback on the first-run setup screen — the first
screen any new admin sees:

- Use the bundled PicPeak logo (same asset the login page falls back to)
  on the cream brand plate instead of the generic lucide Sparkles icon.
- Split the flow into two steps: step 1 takes only the one-time setup
  token, with the `docker compose logs backend | grep -i "setup token"`
  recovery command shown prominently (with a copy button) directly under
  the field, plus a docs link for when the logs have rotated away; step 2
  collects email + password. A rejected token bounces back to step 1.

en/de strings added; other locales fall back to en.

frontend/src/i18n/locales/de.json

@@ -3465,10 +3465,18 @@
   "setup": {
     "title": "Willkommen bei PicPeak",
     "subtitle": "Erstellen Sie Ihr Administrator-Konto, um loszulegen",
+    "tokenStepSubtitle": "Geben Sie zunächst Ihren einmaligen Setup-Token ein",
+    "accountStepSubtitle": "Erstellen Sie nun Ihr Administrator-Konto",
+    "stepOf": "Schritt {{current}} von {{total}}",
+    "continue": "Weiter",
+    "back": "Zurück",
     "tokenLabel": "Setup-Token",
     "tokenPlaceholder": "Einmaligen Setup-Token einfügen",
     "tokenHint": "Wird beim ersten Start in den Server-Logs ausgegeben (auch in data/SETUP_TOKEN gespeichert).",
     "tokenRequired": "Der Setup-Token ist erforderlich",
+    "tokenCommandLabel": "Token nicht gefunden? Führen Sie dies im Projektverzeichnis aus:",
+    "copyCommand": "Befehl kopieren",
+    "tokenRotatedLink": "Logs bereits rotiert? Zur Einrichtungsanleitung",
     "tokenLocationHint": "Nicht gefunden? Führen Sie aus: docker compose logs backend | grep -i \"setup token\"",
     "invalidToken": "Dieser Setup-Token ist ungültig.",
     "passwordRequirements": "Verwenden Sie mindestens 8 Zeichen mit einem Groß- und einem Kleinbuchstaben sowie einer Ziffer.",

frontend/src/i18n/locales/en.json

@@ -3361,10 +3361,18 @@
   "setup": {
     "title": "Welcome to PicPeak",
     "subtitle": "Create your administrator account to get started",
+    "tokenStepSubtitle": "First, enter your one-time setup token",
+    "accountStepSubtitle": "Now create your administrator account",
+    "stepOf": "Step {{current}} of {{total}}",
+    "continue": "Continue",
+    "back": "Back",
     "tokenLabel": "Setup token",
     "tokenPlaceholder": "Paste the one-time setup token",
     "tokenHint": "Printed to the server logs on first start (also saved to data/SETUP_TOKEN).",
     "tokenRequired": "The setup token is required",
+    "tokenCommandLabel": "Can't find your token? Run this in the project directory:",
+    "copyCommand": "Copy command",
+    "tokenRotatedLink": "Logs already rotated away? Read the setup guide",
     "tokenLocationHint": "Can't find it? Run: docker compose logs backend | grep -i \"setup token\"",
     "invalidToken": "That setup token is not valid.",
     "passwordRequirements": "Use at least 8 characters with an upper-case letter, a lower-case letter and a number.",