feat: auto-persist JWT secret, remove setup token requirement

- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields

static/login.html

@@ -273,19 +273,6 @@
                     >
                 </div>
                 
-                <div class="auth-input-group">
-                    <label class="auth-label" for="admin-setup-token">Setup token</label>
-                    <input
-                        type="text"
-                        id="admin-setup-token"
-                        class="auth-input"
-                        placeholder="Paste the one-time token from the server log"
-                        required
-                        autocomplete="off"
-                    >
-                    <small style="color: var(--text-secondary, #666); margin-top: 4px; display: block;">Check the server console output for the setup token.</small>
-                </div>
-
                 <button type="submit" class="auth-button" data-i18n="auth.create_admin">Create administrator</button>
             </form>