feat(router): add setup redirect middleware and setup routes

Add setupRedirectMiddleware that checks the setup_complete system
setting on every request. If setup is incomplete, all non-setup
requests are redirected to /setup so the wizard is the first thing
new users see. The check uses an in-memory cache (10s TTL) to avoid
hitting the database on every request, with cache invalidation on
setup completion.

The middleware skips /setup, /api/*, /static/*, /health, and
/favicon.ico so the wizard page, API calls, and static assets load
normally during setup.

Register two new routes:
- GET /setup: renders the setup wizard SSR template
- PUT /api/setup/complete: marks setup as complete (JWT-protected,
  requires an authenticated admin user created in step 1)

internal/router/router.go

@@ -188,6 +188,9 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 	}
 	e.Validator = &CustomValidator{validator: v}
 
+	// Setup redirect middleware - must run before all routes
+	e.Pre(setupRedirectMiddleware(cfg))
+
 	// Rate limiter
 	rateLimiterConfig := ratelimit.RateLimiterConfig{
 		Enabled:           cfg.Cfg.RateLimitEnabled,
@@ -206,6 +209,7 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 	cfg.ScannerHandler = scannerHandler
 
 	// Register route groups
+	registerSetupRoutes(cfg)
 	registerAuthRoutes(cfg, rateLimitMiddleware)
 	registerLibraryRoutes(cfg)
 	registerDeviceRoutes(cfg)