fix(auth): prevent SetupPage remount from wiping freshly-set auth token (#1481)

After #1470 moved routing into react-router, SetupPage is rendered at two
different tree positions (top-level guard + /setup Route). When register
success flushSync-sets `user`, the top-level guard stops matching and the
Route-level SetupPage mounts as a new instance, re-running its cleanup
useEffect and removing the auth_token that handlePostAuthSuccess just wrote.
Subsequent requests 401 and bounce the user back to /login.

Redirect /setup to /welcome when user is already set so SetupPage is never
re-mounted during the auth transition.

web/src/router/AppRoutes.tsx

@@ -439,7 +439,9 @@ export function AppRoutes() {
         <Route
           path={ROUTES.setup}
           element={
-            systemConfig?.initialized ? (
+            user ? (
+              <Navigate to={ROUTES.welcome} replace />
+            ) : systemConfig?.initialized ? (
               <Navigate to={ROUTES.login} replace />
             ) : (
               <SetupPage />