Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

frontend/src/router/index.js

@@ -2,7 +2,8 @@ import { createRouter, createWebHistory } from 'vue-router'
 import { useAuthStore } from '../stores/auth'
 import AppLayout from '../views/AppLayout.vue'
 import SettingsLayout from '../views/settings/SettingsLayout.vue'
-import { setupComplete, setupSkipped, isSetupLoaded, refreshSetupState } from '../composables/setupState'
+import { setupComplete, setupSkipped, isSetupLoaded, refreshSetupState,
+         needsAdmin, isNeedsAdminLoaded, refreshNeedsAdmin } from '../composables/setupState'
 import { loadEnabledPlugins, isPluginEnabled } from '../composables/enabledPlugins'
 import { useToast } from '../composables/toast'
 import { getFacilityName } from '../utils/siteSettings'
@@ -196,6 +197,24 @@ router.afterEach(() => {
 router.beforeEach(async (to, from, next) => {
   const authStore = useAuthStore()
 
+  // FIRST RUN: until an admin exists, nothing else in the app is useful. Without
+  // this, a fresh instance serves an anonymous dashboard and the operator has no
+  // indication that setup is unfinished (they must guess their way to /login).
+  // Unauthenticated only, so it costs an established site nothing.
+  if (!authStore.isAuthenticated && to.path !== '/login') {
+    if (!isNeedsAdminLoaded()) {
+      // Bounded like the plugin gate: a hung request must not hold navigation
+      // open. refreshNeedsAdmin fails open on error.
+      await Promise.race([
+        refreshNeedsAdmin(),
+        new Promise(resolve => setTimeout(resolve, 4000)),
+      ])
+    }
+    if (needsAdmin.value) {
+      return next({ path: '/login', query: { firstrun: '1' } })
+    }
+  }
+
   if (to.meta.requiresAuth && !authStore.isAuthenticated) {
     // Remember where they were headed so login can send them back there.
     return next({ path: '/login', query: { redirect: to.fullPath } })