fix(event-types): harden setup window + catalog validation (codex review)

Three review rounds on PR #801; fixes in response:

- isValidEventType: live catalog is authoritative when it has rows — a
  deleted or deactivated slug no longer validates via the legacy
  fallback (fallback now only serves an empty-catalog install)
- deleteEventType: refuse deleting the last (and last ACTIVE) type;
  updateEventType: refuse deactivating the last active type (unknown
  slugs are rejected since the validator change, so an empty active
  catalog would brick event creation)
- setup window fails closed: only an explicit stored `false` opens it
  (a portable-backup restore can leave the key absent) and a normal
  admin login durably closes it (abandoned-wizard case)
- reserved bootstrap keys (setup_wizard_completed, setup_token) are
  stripped from ALL generic settings upserts (/general, /security,
  /analytics, /seo) so the marker is genuinely one-way
- wizard step: deletes ordered so the catalog can never end up empty,
  and a genuinely failed system-type deletion reloads the list and
  stays on the step instead of advancing past the only window in which
  it can be retried
- CreateEventPage: snap the hardcoded initial 'wedding' selection to
  the first active type when the catalog no longer contains it
- v1 API: new GET /event-types (read scope) so token clients can
  discover valid slugs; OpenAPI enum replaced with the live-catalog
  description

backend/src/services/setupService.js

@@ -28,7 +28,12 @@ const SETUP_TOKEN_KEY = 'setup_token';
 const SETUP_WIZARD_COMPLETED_KEY = 'setup_wizard_completed';
 
 async function isSetupWizardCompleted() {
-  return (await getAppSetting(SETUP_WIZARD_COMPLETED_KEY)) === true;
+  // Fail closed: only an explicit stored `false` (seeded by migration 161 on
+  // a fresh, admin-less install) opens the deletion window. A missing row —
+  // e.g. app_settings replaced by a portable-backup restore that predates the
+  // migration, which will not rerun — means a configured instance, not a
+  // first run.
+  return (await getAppSetting(SETUP_WIZARD_COMPLETED_KEY)) !== false;
 }
 
 async function markSetupWizardCompleted() {