feat: add onboarding setup flow with nickname and password

Replace default auto-generated password with a first-run setup page that
lets users choose their own nickname and password. The /auth/setup endpoint
now accepts an optional nickname field (also sets site_name). Remove
set_default_password() since setup is now mandatory before login.

api/app/schemas/auth.py

@@ -1,3 +1,5 @@
+from typing import Optional
+
 from pydantic import BaseModel, Field, field_validator
 
 
@@ -26,3 +28,21 @@ class ChangePasswordRequest(BaseModel):
 class AuthStatusResponse(BaseModel):
     authenticated: bool
     user_id: str
+
+
+class SetupPasswordRequest(BaseModel):
+    password: str = Field(..., min_length=6, max_length=100)
+    nickname: Optional[str] = Field(None, min_length=1, max_length=50)
+
+    @field_validator("password")
+    @classmethod
+    def validate_password_strength(cls, v: str) -> str:
+        if len(v) < 6:
+            raise ValueError("密码长度至少6位")
+        if len(set(v)) < 3:
+            raise ValueError("密码不能过于简单（需包含至少3种不同字符）")
+        return v
+
+
+class AuthSetupStatusResponse(BaseModel):
+    has_password: bool