fix(auth): close the three leftovers E9.5 logged but kept out of its diff

DX-17, three one-liners the epic's canonical sweep did not reach:

`routes/setup.py::setup_admin` still resolved the wizard's admin by
literal `User.email ==`. The wizard can be re-run, and E9.5's premise is
that two spellings of one Gmail mailbox are one person — so a second run
under the other spelling would have created exactly the duplicate admin
row the epic exists to prevent.

`routes/admin.py::_decide` hand-rolled `db.get` + 404 where the file's
newer endpoints use `get_or_404`. There were TWO such sites, not the one
the review named; both are converted, per the house rule that a
principle gets fixed everywhere in one sweep.

`useVerifyEntry`'s `hashchange` listener recognised `#verify=` but not
`#reset=`, so pasting a reset link into a tab already running the app
was silently ignored — the same silence that made the verify half a bug.
It now notices, and says out loud that reset links need a signed-out
window; the fragment is still deliberately left in the address bar
(review round 4), so signing out from that tab recovers it.

DX-16: `.catch(() => setOutcome("invalid"))` could not tell a spent
token from a 502 mid-deploy or a dropped connection, and by then the
fragment is cleared — so a network blip was reported as "that link is no
longer valid", pushing the user to request a fresh one on the strength
of a false statement. Only a 400 carrying {code:"verify"} is the
server's verdict now; everything else gets its own outcome, with no
resend CTA, because the token is untouched and retrying it works. The
rule was already written one file away for the reset-link probe: "a
network blip must never be cached as 'this link is dead'".

Two existing tests asserted the old conflation by rejecting with a bare
Error("400"); they now reject with the real HttpError. The errors are
built inside the rejection, not hoisted: mountAt calls vi.resetModules(),
so an HttpError imported earlier is a different class identity and
`instanceof` would quietly miss.

Gate: vitest 671 -> 676, pytest 924 -> 925.

frontend/src/components/welcomeMode.render.dom.test.tsx

@@ -32,7 +32,12 @@ import type { VerifyEntry } from "../lib/useVerifyEntry";
 
 // App confirms the emailed token and hands the outcome down; these tests are about the card's
 // sub-views, so there is nothing to report.
-const noVerify: VerifyEntry = { outcome: null, email: null, dismiss: () => {} };
+const noVerify: VerifyEntry = {
+  outcome: null,
+  email: null,
+  resetPending: false,
+  dismiss: () => {},
+};
 
 const back = () =>
   act(() => {
@@ -91,6 +96,7 @@ describe("the verification outcome handed down from App", () => {
   const withOutcome = (outcome: VerifyEntry["outcome"]): VerifyEntry => ({
     outcome,
     email: "someone@example.com",
+    resetPending: false,
     dismiss: () => {},
   });
 
@@ -112,6 +118,15 @@ describe("the verification outcome handed down from App", () => {
     expect(screen.getByText("welcome.auth.resendCta")).toBeTruthy();
   });
 
+  // DX-16: a transport failure is not a verdict on the token, so it must NOT offer a fresh link —
+  // that would act on a statement we know to be false. Retrying the same link is the way out.
+  it("does not offer a new link when the server was merely unreachable", async () => {
+    render(<Welcome verify={withOutcome("unreachable")} />);
+    expect(await screen.findByText("welcome.auth.verifyUnreachable")).toBeTruthy();
+    expect(screen.queryByText("welcome.auth.resendCta")).toBeNull();
+    expect(screen.queryByText("welcome.auth.verifyInvalid")).toBeNull();
+  });
+
   it("shows no banner when there was no token to confirm", async () => {
     render(<Welcome verify={noVerify} />);
     await screen.findByText("welcome.auth.signinTitle");