fix: restore /setup access after manager login

[wra-sol]

Problem

After the manager session auth gate was added, /setup (the reconfigure wizard) requires logging in at /manage/login first. Several edge cases prevented reliable access:

• The next redirect parameter was not URL-encoded (?next=/setup), which some proxies/browsers parse incorrectly
• A failed login attempt dropped the next=/setup target, sending users to /manage instead
• Already-authenticated users hitting /manage/login saw the login form again instead of being forwarded
• Session cookies lacked the Secure flag behind Railway's HTTPS proxy (X-Forwarded-Proto: https)
• Unauthenticated POST /setup returned raw 401 JSON instead of redirecting to login
• /setup/ (trailing slash) did not match the setup route and fell through to the proxy

Fix

• URL-encode next in all login redirect URLs (next=%2Fsetup)
• Preserve next from the POST body when re-rendering the login form after a wrong password
• Redirect authenticated users away from /manage/login to their intended destination
• Add Secure to session cookies when X-Forwarded-Proto is https
• Normalize trailing slashes on request paths (/setup/ → /setup)
• Redirect unauthenticated POST /setup to the login page

Tests

Added 6 integration tests covering encoded redirects, login→setup flow, wrong-password next preservation, authenticated login skip, unauth POST redirect, and trailing-slash handling. All 86 tests pass.

How to verify after deploy

1. Open /setup on a configured server → should redirect to /manage/login?next=%2Fsetup
2. Log in with your setup password → should land on the reconfigure form
3. From /manage, click Reconfigure → /setup should load without another login prompt (while session is valid)