feat: add backup recovery, setup wizard and user-view guards

backend/app/db.py

@@ -929,6 +929,10 @@ def get_request_download_evidence(request_id: str, limit: int = 100) -> Dict[str
 def ensure_admin_user() -> None:
     if not settings.admin_username or not _has_secure_bootstrap_admin_credentials():
         return
+    # Environment credentials bootstrap only the first administrator. In
+    # particular, do not inject a destination host's account into a restored DB.
+    if has_admin_user():
+        return
     existing = get_user_by_username(settings.admin_username)
     if existing:
         return