fix(setup): use /api/setup endpoint for admin creation

The admin setup form was calling /api/auth/register which creates a
regular user (role is hardcoded to User) and never sets the
system_initialized flag. Switch to /api/setup which creates an actual
admin and marks the system as initialized. Add setup token input field.

static/login.html

@@ -273,6 +273,19 @@
                     >
                 </div>
                 
+                <div class="auth-input-group">
+                    <label class="auth-label" for="admin-setup-token">Setup token</label>
+                    <input
+                        type="text"
+                        id="admin-setup-token"
+                        class="auth-input"
+                        placeholder="Paste the one-time token from the server log"
+                        required
+                        autocomplete="off"
+                    >
+                    <small style="color: var(--text-secondary, #666); margin-top: 4px; display: block;">Check the server console output for the setup token.</small>
+                </div>
+
                 <button type="submit" class="auth-button" data-i18n="auth.create_admin">Create administrator</button>
             </form>