[codex] Mask setup generated secrets

[Rabithua]

Summary

• Stop returning raw generated JWT/session/VAPID private secrets from the first-run setup response.
• Keep the existing setup flow unchanged for normal deployments.
• Split the oversized admin router into setup, storage utility, and user/admin route modules so the project quality gate can pass.

Root Cause

POST /v2/api/admin/setup generated security keys and then included the raw private values in the response payload.

Validation

• bun test tests/setupSecurity.test.ts
• bun run lint
• bun run build