feat: first-run setup wizard, CLI seed script, and installation docs

- /setup Server Component + SetupClient form + createFirstAdmin Server Action:
  zero-users guard (TOCTOU-safe), argon2 hash, ADMIN user creation,
  redirects to /auth/signin after setup
- scripts/setup-admin.mjs: CLI alternative for headless/container setups
- docs/installation.md: 7-section install guide (clone → configure → run → verify)

Co-Authored-By: claude-flow <ruv@ruv.net>

apps/web/src/app/setup/page.tsx

@@ -0,0 +1,11 @@
+import { redirect } from "next/navigation";
+import { prisma } from "@capakraken/db";
+import { SetupClient } from "./SetupClient.js";
+
+export default async function SetupPage() {
+  const count = await prisma.user.count();
+  if (count > 0) {
+    redirect("/auth/signin");
+  }
+  return <SetupClient />;
+}