v0.6.1-beta: Auth Bootstrap Fix

[DeepZone]

Motivation

• Fix a broken frontend bootstrap that never showed the initial admin Setup screen, allowing unauthenticated checks that caused backend crashes.
• Ensure the app deterministically chooses between Setup / Login / App views on startup and shows a Loading/ Error state while resolving auth.
• Harden backend auth checks so protected check endpoints cannot be executed with a missing current_user and return 401/403 instead of raising a 500.

Description

• Frontend bootstrapping was reworked in frontend/src/App.tsx to always call GET /api/auth/setup-required first and then conditionally call GET /api/auth/me; added explicit loading, setup, login, app, and error modes to gate rendering.
• Added SetupView and LoginView components at frontend/src/components/SetupView.tsx and frontend/src/components/LoginView.tsx implementing initial admin setup (POST /api/auth/setup) and login (POST /api/auth/login) flows with visible error handling.
• API client (frontend/src/api.ts) now uses credentials: 'include' for all fetch calls and exposes getSetupRequired, getMe, setupAdmin, and login helpers used by the bootstrap flow.
• Backend auth enforcement tightened in backend/app/core/auth.py by removing the special-case path that returned None when no users exist so require_role and role-based dependencies call get_current_user and properly return 401/403 rather than allowing unauthenticated access.
• Tests updated in backend/tests/test_api_smoke.py to cover setup-required behavior, 401 when unauthenticated, 403 for viewer role, and 200 for operator/admin; added helper to create/login the initial admin in tests.
• Bumped user-facing and package versions to v0.6.1-beta / 0.6.1 across backend/frontend/metadata and updated README.md and RELEASE_NOTES.md with Auth Bootstrap Fix highlights.

Testing

• Ran backend smoke tests: pytest backend/tests/test_api_smoke.py -q which passed (tests in that file passed).
• Built frontend: cd frontend && npm run build which completed successfully and produced a production build.
• No other behavioral changes to routing or external systems were introduced; check endpoints remain protected by role dependencies and now return appropriate 401/403 status codes instead of 500 on missing or insufficient auth.

---

Codex Task