refactor(api): extract account/auth/setup/admin; façade is now spread-only (R7.5 S2)

Move the last four inline domains out of lib/api.ts into per-domain slices,
each owning its types + method slice. The barrel now holds ZERO endpoint logic
and zero types of its own — it only re-exports core's HTTP machinery, re-exports
each domain's types, and spreads the 15 slices into the single `api` object.

A new endpoint therefore has nowhere to land but a domain module. The `api`
shape and all call sites are unchanged (every req/beacon call byte-identical
to dev; no method dropped, no key collision).

frontend/src/lib/api/setup.ts

@@ -0,0 +1,30 @@
+// First-run install wizard: probes install state and drives admin/config/email setup with the
+// one-time token printed to the container logs (carried via setupHeaders). Every write is quiet so
+// the wizard renders errors inline. Only touches core's req + setupHeaders.
+import { req, setupHeaders } from "./core";
+
+export const setupApi = {
+  setupStatus: (): Promise<{ configured: boolean }> => req("/api/setup/status"),
+  setupInfo: (token: string): Promise<{ secrets_manageable: boolean }> =>
+    req("/api/setup/info", { headers: setupHeaders(token) }, { quiet: true }),
+  setupAdmin: (token: string, email: string, password: string): Promise<{ ok: boolean }> =>
+    req(
+      "/api/setup/admin",
+      { method: "POST", headers: setupHeaders(token), body: JSON.stringify({ email, password }) },
+      { quiet: true },
+    ),
+  setupConfig: (token: string, values: Record<string, unknown>): Promise<{ saved: string[] }> =>
+    req(
+      "/api/setup/config",
+      { method: "POST", headers: setupHeaders(token), body: JSON.stringify(values) },
+      { quiet: true },
+    ),
+  setupTestEmail: (token: string, to: string): Promise<{ ok: boolean }> =>
+    req(
+      "/api/setup/test-email",
+      { method: "POST", headers: setupHeaders(token), body: JSON.stringify({ to }) },
+      { quiet: true },
+    ),
+  setupFinish: (token: string): Promise<{ ok: boolean }> =>
+    req("/api/setup/finish", { method: "POST", headers: setupHeaders(token) }, { quiet: true }),
+};