feat: auto-persist JWT secret, remove setup token requirement

- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields

static/js/features/auth/auth.js

@@ -730,7 +730,6 @@ if (isLoginPage && adminSetupForm) {
     
     try {
         // Use the /api/setup endpoint which creates an admin and marks the system as initialized
-        const setupToken = document.getElementById('admin-setup-token').value;
         const response = await fetch('/api/setup', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...getCsrfHeaders() },
@@ -738,8 +737,7 @@ if (isLoginPage && adminSetupForm) {
             body: JSON.stringify({
                 username: 'admin',
                 email,
-                password,
-                setup_token: setupToken
+                password
             })
         });
         if (!response.ok) {