- POST /api/setup/admin (create the first admin: active+verified+admin), /config (persist any registry-backed settings — Google creds, SMTP, quota…), /test-email, and /finish (mark configured + invalidate the token). All behind require_setup (valid token AND not configured). - GET /api/setup/info reports secrets_manageable so the wizard hides the Google/SMTP secret steps on a box without TOKEN_ENCRYPTION_KEY.