fix(setup): use /api/setup endpoint for admin creation

The admin setup form was calling /api/auth/register which creates a
regular user (role is hardcoded to User) and never sets the
system_initialized flag. Switch to /api/setup which creates an actual
admin and marks the system as initialized. Add setup token input field.

static/js/features/auth/auth.js

@@ -729,9 +729,25 @@ if (isLoginPage && adminSetupForm) {
     }
     
     try {
-        // Register admin account
+        // Use the /api/setup endpoint which creates an admin and marks the system as initialized
-        const data = await register('admin', email, password, 'admin');
+        const setupToken = document.getElementById('admin-setup-token').value;
-        
+        const response = await fetch('/api/setup', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...getCsrfHeaders() },
+            credentials: 'same-origin',
+            body: JSON.stringify({
+                username: 'admin',
+                email,
+                password,
+                setup_token: setupToken
+            })
+        });
+        if (!response.ok) {
+            const err = await response.json().catch(() => ({}));
+            throw new Error(err.message || 'Setup failed');
+        }
+        const data = await response.json();
+
         // Show success message in the GUI instead of alert
         const successMsg = window.i18n ? window.i18n.t('auth.admin_success') : 'Admin account created successfully! You can now log in.';
         

static/login.html

@@ -273,6 +273,19 @@
                     >
                 </div>
                 
+                <div class="auth-input-group">
+                    <label class="auth-label" for="admin-setup-token">Setup token</label>
+                    <input
+                        type="text"
+                        id="admin-setup-token"
+                        class="auth-input"
+                        placeholder="Paste the one-time token from the server log"
+                        required
+                        autocomplete="off"
+                    >
+                    <small style="color: var(--text-secondary, #666); margin-top: 4px; display: block;">Check the server console output for the setup token.</small>
+                </div>
+
                 <button type="submit" class="auth-button" data-i18n="auth.create_admin">Create administrator</button>
             </form>