Connect first-admin setup to first mailbox onboarding

[zaridan]

First-admin setup already exists and should not be rebuilt.

This issue tracks the remaining first-run onboarding gap: after the first admin is created and signed in, the operator needs a clear path to connect the first mailbox and verify the first successful conversation flow.

Current state:

• /setup creates the first admin on a zero-Agent deployment.
• /login redirects to /setup when setup is still needed.
• POST /api/v1/setup is transactionally guarded and creates an active admin with a password identity.
• The Settings UI does not yet provide a first-mailbox connection path.

Acceptance:

• Fresh deploy redirects from login to first-admin setup.
• Successful setup signs the admin in and routes them to a useful next step.
• If no mailbox is connected, the UI clearly prompts the admin to connect one.
• Gmail OAuth connect can be started from the UI, not by raw curl.
• First inbound and outbound round trip can be verified.
• Docs describe the setup sequence without implying first-admin setup is missing.