feat(setup): first-boot detection + setup-mode gating + one-time token (epic 6a)

- app_state gains configured + setup_token_hash (migration 0025); existing installs (any users)
  are marked configured so they never see the wizard, a fresh DB starts in setup mode.
- On first boot the app mints a one-time setup token and logs the wizard URL (only the hash is
  stored); the token gates the setup steps (added in 6c).
- A middleware locks all /api + /auth routes (except /api/setup, /api/version, /healthz, static)
  to 503 until configured, with a DB-free cached fast-path once setup completes.
- GET /api/setup/status tells the SPA whether to show the wizard.

backend/app/models.py

@@ -383,6 +383,14 @@ class AppState(Base):
     # Admin override for the maintenance job's rolling re-validation batch (videos re-checked
     # per run). NULL = use the config/env default (settings.maintenance_revalidate_batch).
     maintenance_revalidate_batch: Mapped[int | None] = mapped_column(Integer)
+    # First-run install wizard. `configured` is False on a fresh instance (the app runs in
+    # setup mode: only the wizard works) and flipped True when the wizard finishes. While
+    # unconfigured, a one-time setup token (only its SHA-256 hash stored) gates the wizard;
+    # the raw token + URL are printed to the container logs on each startup.
+    configured: Mapped[bool] = mapped_column(
+        Boolean, default=False, server_default="false"
+    )
+    setup_token_hash: Mapped[str | None] = mapped_column(String(64))
 
 
 class SchedulerSetting(Base):