Security: restrict setup form to explicit fields

[nicdavidson]

Summary

• Replace request->all() with request->only() in SplashController POST handler
• Prevents mass assignment of unexpected fields during first admin setup
• Only allows: email, name, first_name, last_name, username, phone, password, password_confirmation

Test plan

• Setup flow only accepts expected fields
• createFirstAdmin still receives all required data