Create first admin (one-time setup)

First-run setup: create the first admin user and auto-login.

Unauthenticated by design — there is no admin to authenticate as yet. The operation self-closes once any user exists (returns 410 setup_already_complete thereafter), so it is safe to expose only during first boot.