refactor(setup): derive setup-complete status from admin user count

Setup completion was previously tracked by a manually-flipped setup_complete row in system_settings, written via a JWT-protected PUT /api/setup/complete endpoint. This meant any admin user created outside the setup wizard (future CLI, seed scripts, direct DB inserts) would not flip the switch, leaving the app stuck redirecting to /setup.

The trigger is now derived from real data: setup is complete iff at least one admin user exists. This is self-correcting regardless of how users are created, and re-engages setup automatically if all admins are ever removed.

Changes:
- Add internal/setupstatus package with IsSetupComplete() (queries CountAdmins, 10s in-memory cache, fails open on DB error) and Invalidate() to clear the cache. Uses an AdminCounter interface to avoid importing the database package.
- Add CountAdmins sqlc query (SELECT COUNT(*) FROM users WHERE role = 'admin') and regenerate.
- Rewire router/setup.go isSetupComplete() to delegate to setupstatus; drop the old setup_complete setting read, cache vars, and the PUT /api/setup/complete route.
- Call setupstatus.Invalidate() in the auth handler after CreateUser, UpdateUserRole, and DeleteUser so the cache reflects admin-count changes immediately.
- Align first-user promotion in Register to key off !adminExists instead of len(users) == 0, so the two checks cannot diverge.
- Remove the now-dead SetSetupComplete/GetSetupStatus handlers.
- Drop the setup_complete seed row from schema.sql.
- Remove the apiPut('/setup/complete') call from the setup wizard finishSetup(); the admin account created in submitAdmin already marks setup complete server-side.

web/src/setup.ts

@@ -460,15 +460,13 @@ function initSetup(): void {
   async finishSetup() {
     this.loading = true;
     try {
-      const response = await apiPut("/setup/complete");
-      await handleVoidResponse(response);
+      // Setup completion is derived from the existence of an admin user, so
+      // there is no separate "complete" endpoint to call. The admin account
+      // created in submitAdmin already marks setup as done server-side.
       if (this.libraries.length > 0) {
         setSelectedLibrary(this.libraries[0].id);
       }
       window.location.href = "/dashboard";
-    } catch (err) {
-      handleError(err, "Failed to complete setup");
-      window.location.href = "/dashboard";
     } finally {
       this.loading = false;
     }