fix: improve SPC dashboard UX — hover toolbar, visible report errors

- Change Plotly modebar to hover-only mode to avoid overlapping chart content
- Remove redundant Plotly titles (container headers already provide them)
- Add Content-Type check and inline error display for report downloads
- Fix setup login validation and seed idempotency for existing data

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/templates/setup/setup.html

@@ -603,7 +603,8 @@
                 showToast('Setup is disabled. Set SETUP_PASSWORD in .env', 'error');
                 return;
             }
-            // Password accepted (status endpoint is accessible)
+            // Validate password via init-db (idempotent, no tables needed)
+            await apiPost('/init-db', { password: pwd });
             setupPassword = pwd;
             document.getElementById('login-screen').classList.add('hidden');
             document.getElementById('setup-panel').classList.remove('hidden');
@@ -611,7 +612,11 @@
             await loadUsers();
             showToast('Setup panel unlocked', 'success');
         } catch (e) {
-            showToast('Connection error: ' + e.message, 'error');
+            if (e.message.indexOf('403') !== -1 || e.message.indexOf('Invalid') !== -1) {
+                showToast('Invalid setup password', 'error');
+            } else {
+                showToast('Connection error: ' + e.message, 'error');
+            }
         } finally {
             setLoading('btn-login', false);
         }