remove preact and create setup wizard

.project/specs/authentication-api.md

@@ -8,6 +8,8 @@ Browser users authenticate with passkeys or password fallback. Successful login
 
 Endpoints:
 
+- `GET /setup`
+- `POST /api/setup`
 - `GET /login`
 - `GET /account`
 - `POST /api/auth/register/password`
@@ -21,7 +23,12 @@ Endpoints:
 - `POST /api/auth/passkeys/login/begin`
 - `POST /api/auth/passkeys/login/finish?challengeId=...`
 
-The first registered user bootstraps as `admin`. Later public registrations become `viewer`; role changes are admin-managed from the account screen. Public registration endpoints only create new accounts. Adding or changing credentials on an existing account requires an authenticated browser session.
+On an empty database, the one-time `/setup` wizard creates the first `admin`
+account and records whether public signup is enabled. Later public
+registrations are accepted only when that setting is enabled and always become
+`viewer`; role changes are admin-managed from the account screen. Public
+registration endpoints only create new accounts. Adding or changing
+credentials on an existing account requires an authenticated browser session.
 
 ## API Tokens
 
@@ -64,7 +71,8 @@ This is intentionally inspired by OAuth device authorization, but it is not a ge
 
 ## Route Protection
 
-- Public: health, static assets, document reads, login/account entry pages, password/passkey begin-login/register endpoints, device start/token polling.
+- Setup-only until configured: initial setup page and endpoint.
+- Public: health, static assets, document reads, login/account entry pages, password/passkey begin-login/register endpoints when signups are enabled, device start/token polling.
 - Session or bearer token required: auth profile/logout, edit/save APIs, uploads, sync/content APIs, device approval.
 - Admin role required: admin APIs and API token management.