fix(setup): confronto costante, blocco dopo l'init, status minimale (#9)

_check_password confrontava la password con !=, ora hmac.compare_digest.

Nuova guardia _require_not_initialised: se esiste già un admin,
reset-db, seed, manage-user, change-user-password e init-db rispondono
403 "setup already completed", a meno di settings.setup_allow_after_init
(nuovo, env SETUP_ALLOW_AFTER_INIT, default False). create-admin,
list-users e toggle-user-active restano fuori dalla guardia.

GET /api/setup/status senza password valida restituisce solo
{"initialised": bool}; l'elenco tabelle solo con la password.

Adeguati i test esistenti che seedavano un admin e poi richiamavano un
endpoint ora guardato (test_setup.py, test_station_seed.py: bypassano
la guardia con setup_allow_after_init quando serve testare altro).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/backend/tests/test_station_seed.py

@@ -83,11 +83,17 @@ async def test_setup_seed_creates_default_station_and_assigns_recipes(
 async def test_setup_seed_station_idempotent(
     client: AsyncClient,
     db_session: AsyncSession,
+    monkeypatch,
 ):
     """Running seed twice must not duplicate ST-DEFAULT or its assignments."""
     # First run — creates everything.
     await _seed(client)
 
+    # Second run: the first seed already created an admin, so this exercises
+    # setup's own "setup already completed" guard (#9) unless bypassed - the
+    # idempotency this test is about is seed's, not the guard's.
+    monkeypatch.setattr(settings, "setup_allow_after_init", True)
+
     # Second run — recipe DEMO-001 already exists → seed returns early.
     # ST-DEFAULT must still exist (not re-created, not duplicated).
     resp = await client.post("/api/setup/seed", json={"password": SETUP_PWD})