feat: auto-persist JWT secret, remove setup token requirement

- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields

static/js/features/auth/auth.js

@@ -730,7 +730,6 @@ if (isLoginPage && adminSetupForm) {
     
     try {
         // Use the /api/setup endpoint which creates an admin and marks the system as initialized
-        const setupToken = document.getElementById('admin-setup-token').value;
         const response = await fetch('/api/setup', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json', ...getCsrfHeaders() },
@@ -738,8 +737,7 @@ if (isLoginPage && adminSetupForm) {
             body: JSON.stringify({
                 username: 'admin',
                 email,
-                password,
-                setup_token: setupToken
+                password
             })
         });
         if (!response.ok) {

static/login.html

@@ -273,19 +273,6 @@
                     >
                 </div>
                 
-                <div class="auth-input-group">
-                    <label class="auth-label" for="admin-setup-token">Setup token</label>
-                    <input
-                        type="text"
-                        id="admin-setup-token"
-                        class="auth-input"
-                        placeholder="Paste the one-time token from the server log"
-                        required
-                        autocomplete="off"
-                    >
-                    <small style="color: var(--text-secondary, #666); margin-top: 4px; display: block;">Check the server console output for the setup token.</small>
-                </div>
-
                 <button type="submit" class="auth-button" data-i18n="auth.create_admin">Create administrator</button>
             </form>