feat(frontend): gate first run on needs-admin so a fresh instance shows the wizard

A fresh install landed on the anonymous dashboard instead of prompting to create
the first admin, so an operator had no way to discover /setup.

The router now asks /api/setup/needs-admin before rendering any unauthenticated
route and redirects to /login?firstrun=1 while no user exists. The result is
cached in a composable so it costs one request per session, and the lookup fails
open (a backend that cannot answer must not lock the login screen). Racing it
against a 4s timeout keeps a slow or hung backend from blocking the first paint.

Login.vue clears the flag after creating the admin so the gate stops firing
without a reload.

frontend/src/views/Login.vue

@@ -51,6 +51,7 @@ import { ref, onMounted } from 'vue'
 import { useRouter, useRoute } from 'vue-router'
 import { useAuthStore } from '../stores/auth'
 import { setupApi } from '../api'
+import { clearNeedsAdmin } from '../composables/setupState'
 import { getSiteLogo } from '../utils/siteSettings'
 import { withBase, stripBase } from '../utils/basePath'
 
@@ -102,6 +103,7 @@ async function handleCreateAdmin() {
   loading.value = true
   try {
     await setupApi.createAdmin({ username: username.value, email: email.value, password: password.value })
+    clearNeedsAdmin()   // an admin now exists; stop the first-run gate firing
     // Log straight in with the new credentials, then on to the setup wizard.
     const result = await authStore.login(username.value, password.value)
     if (result.success) router.push('/setup')