Add first-run setup wizard and file browser for library creation

- On first start (no users in DB), show a setup page in the web UI
  to create the admin account instead of reading credentials from .env
- New public endpoints: GET /api/setup/status, POST /api/setup
- New admin endpoint: GET /api/filebrowser?path=... for directory listing
- FileBrowser modal component with navigation, used in Admin > Libraries
- Remove _seed_admin / _seed_default_library from server startup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/setup.py

@@ -0,0 +1,43 @@
+import uuid
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, func
+from pydantic import BaseModel
+from ..dependencies import get_db
+from ..models.user import User
+from ..services.auth import hash_password, create_token
+
+router = APIRouter(prefix="/api/setup", tags=["setup"])
+
+
+class SetupRequest(BaseModel):
+    username: str
+    password: str
+    email: str = ""
+
+
+@router.get("/status")
+async def setup_status(db: AsyncSession = Depends(get_db)):
+    result = await db.execute(select(func.count()).select_from(User))
+    count = result.scalar()
+    return {"needsSetup": count == 0}
+
+
+@router.post("")
+async def run_setup(body: SetupRequest, db: AsyncSession = Depends(get_db)):
+    result = await db.execute(select(func.count()).select_from(User))
+    if result.scalar() > 0:
+        raise HTTPException(status_code=400, detail="Setup already completed")
+
+    admin = User(
+        id=str(uuid.uuid4()),
+        username=body.username,
+        email=body.email,
+        password_hash=hash_password(body.password),
+        is_admin=True,
+    )
+    db.add(admin)
+    await db.flush()
+    admin.token = create_token(admin.id)
+    await db.commit()
+    return {"success": True}