Keep gating setup until an account actually exists

Visiting /admin/setup latched setupCompleted=true before any superuser
was created, so a second visit to the bare domain skipped the gate and
landed on /admin/auth — a dead end on a never-set-up instance. Only latch
once a real superuser exists; until then, redirect every non-setup admin
page back to setup.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: elemdos

internal/admin.go

@@ -57,9 +57,18 @@ func RegisterAdminApp(pb *pocketbase.PocketBase) error {
 					setupRequired := superuserCount == 0
 					isSetup := requestEvent.Request.URL.Path == "/admin/setup"
 					isFile := path.Ext(requestEvent.Request.URL.Path) != ""
-					if setupRequired && !isSetup && !isFile {
-						return requestEvent.Redirect(302, "/admin/setup")
+					if setupRequired {
+						// Setup isn't done yet — keep gating. Redirect every
+						// non-setup page (incl. /admin/auth) back to /admin/setup
+						// so an abandoned setup can't leave the instance stuck at
+						// the auth dead-end. Never latch setupCompleted here: a
+						// visit to /admin/setup itself must not count as "done".
+						if !isSetup && !isFile {
+							return requestEvent.Redirect(302, "/admin/setup")
+						}
 					} else {
+						// A real superuser exists — setup is genuinely complete.
+						// Latch so we stop counting superusers on every request.
 						setupCompleted = true
 					}
 				}