Fix fresh-install migration blocker + add preflight, seed admin, first-run endpoints

Validated a clean install on MySQL 5.6 end to end and fixed the blockers.

- migrations/env.py: force alembic_version.version_num to VARCHAR(128) in its
  own committed connection before running migrations. It was VARCHAR(32); the
  revision id 7d02_widen_notification_employee_cols (37 chars) truncated, so the
  next migration's version bump matched 0 rows and `flask db upgrade` died at
  7d03 on a fresh DB. Now upgrades run clean to head.
- flask db-utils preflight: checks Python, required env, DB connectivity, and
  the MySQL 5.6 utf8mb4 index flags (innodb_large_prefix/Barracuda) - the 767
  prerequisite - and prints exact fixes. Exits non-zero on blockers.
- flask seed admin --username --email [--password]: real first-admin command
  (generates + prints a password once). The docs referenced it but only the
  dev-only test-user existed.
- setup endpoints for a UI-driven first run: /setup/needs-admin,
  /setup/create-admin (guarded to zero-users), /setup/seed-reference.
- Wizard: drop the PC-access-domain question (always .device.geaerospace.net);
  the setting keeps its default.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

migrations/env.py

@@ -117,6 +117,27 @@ def run_migrations_online():
 
     connectable = get_engine()
 
+    # Alembic creates alembic_version.version_num as VARCHAR(32), but some
+    # revision ids in this chain exceed 32 chars. On MySQL that truncates the
+    # stored id, so the next migration's version bump matches 0 rows and the
+    # upgrade dies. Force the column wide in its OWN committed connection first
+    # (keeping it out of alembic's migration transaction), so long ids never
+    # truncate - fresh or existing.
+    try:
+        with connectable.connect() as prep:
+            prep.exec_driver_sql(
+                'CREATE TABLE IF NOT EXISTS alembic_version '
+                '(version_num VARCHAR(128) NOT NULL, '
+                'CONSTRAINT alembic_version_pkc PRIMARY KEY (version_num))'
+            )
+            prep.exec_driver_sql(
+                'ALTER TABLE alembic_version MODIFY version_num VARCHAR(128) NOT NULL'
+            )
+            prep.commit()
+    except Exception:
+        # Non-MySQL backends (e.g. sqlite in tests) - alembic's default is fine.
+        pass
+
     with connectable.connect() as connection:
         context.configure(
             connection=connection,