test(e2e): seed setup in e2e-up so local runs match CI

[av1155]

Summary

just e2e-up never created the admin account, while
.github/workflows/browser-e2e.yml does it in a dedicated step. That single
difference makes a local stack diverge from CI in a way that reads as a flaky
test.

POST /setup is what seeds changelog_last_seen_version. Without it,
should_show reaches _parse_version(None) is None and returns True, so
base.html pulls the What's-new modal 800 ms after every page load and
changelog.js opens it with showModal(), which makes the rest of the document
inert. Every click the suite issues after that is intercepted:

57 x waiting for element to be visible, enabled and stable
   - element is visible, enabled and stable
   - <dialog open="" id="changelog-modal" ...> subtree intercepts pointer events

Teardown had a second, compounding problem. It only removed the host path, but
Docker Desktop on macOS keeps bind-mount contents inside its VM, so the
container's /data survived just e2e-down untouched. The stack I hit this on
was still carrying a houndarr.masterkey dated 18 July across many teardowns,
which is why setup kept returning 302 and the marker was never seeded.

Closes #706

Changes

• _up creates the admin account after the health check, mirroring the
  workflow. A 303 means it was created; a 302 means this stack inherited a
  database, and the warning says so and points at just e2e-down. That status
  code is the only reliable signal, because on macOS the host copy of
  DATA_DIR looks empty even when the container's /data is not.
• _teardown clears the data directory through a container before the
  host-side rm, so teardown means the same thing on Linux and macOS. The
  existing DATA_DIR override guard is unchanged, so a custom directory is
  still left alone.
• test_instance_toggle_and_delete_keeps_layout_stable waits for HTMX to settle
  after the second toggle, matching the first. The delete click otherwise
  follows a row swap with no settle wait. This one is hardening rather than a
  fix for an observed failure.

No application code changes. setup_post returning 302 when setup is complete
is correct, and the popup behaviour is correct; the local script simply did not
do what the workflow does.

Testing

The before/after is deterministic rather than a race. On the stale stack,
test_instance_toggle_and_delete_keeps_layout_stable failed 3 runs out of 4.
After just e2e-down && just e2e-up with these changes:

run 1: exit=0    run 2: exit=0    run 3: exit=0    run 4: exit=0

and the full chromium file passes twice, 18 of 18 both times.

The acceptance criteria check out directly. Teardown now empties the container's
/data (verified by mounting it from a throwaway container), e2e-up reports
admin account created, and the popup endpoint returns the empty slot rather
than modal markup:

$ curl -s -b cookies http://localhost:8877/settings/changelog/popup
<div id="changelog-slot" aria-hidden="true"></div>
[HTTP 200]

bash -n and shellcheck are clean on the script. ruff check and
ruff format --check pass. Skipping pytest: the diff is a shell script plus one
e2e-only line, and no unit test covers either. CI runs the three-engine matrix.

Type of Change

• Bug fix (fix:)
• New feature (feat:)
• Refactoring (refactor:)
• Documentation (docs:)
• CI/CD (ci:)
• Chore (chore:)

Checklist

• Issue exists and is linked above with Closes #N
• Linked issue has exactly one type:* and one priority:* label
• Linked issue has at most one phase:* label (or none when not roadmap work)
• Branch name matches issue scope (feat/<slug>, fix/<slug>, etc.)
• Tests added/updated for all changes
• Type check passes (mypy src/)
• Lint passes (ruff check .)
• Format passes (ruff format --check .)
• Documentation updated (if applicable)
• No secrets or sensitive data committed
• Scope check: This change helps search for missing or cutoff-unmet media in a controlled way