feat: add onboarding setup flow with nickname and password

Replace default auto-generated password with a first-run setup page that
lets users choose their own nickname and password. The /auth/setup endpoint
now accepts an optional nickname field (also sets site_name). Remove
set_default_password() since setup is now mandatory before login.

api/app/main.py

@@ -98,7 +98,7 @@ async def auth_middleware(request: Request, call_next):
     path = request.url.path
 
     # 不拦截：健康检查、静态文件、公开的 auth 端点
-    public_paths = {"/health", "/api/auth/login", "/api/auth/logout"}
+    public_paths = {"/health", "/api/auth/login", "/api/auth/logout", "/api/auth/status", "/api/auth/setup"}
     if path in public_paths or not path.startswith("/api/"):
         return await call_next(request)