1.9.0 - first-run setup wizard

What's new:

Introduce setup.php and setup_api.php — a four-step guided wizard that activates automatically when includes/database.json is absent. Covers database connection testing, schema selection, and system table initialization with admin seed. Security: SSRF guard on host param, size-limited JSON input, sanitized error messages, CSP headers.
index.php, login.php, and admin/index.php all redirect to the wizard until configuration is complete.