feat: 启用后端自动启动与 Setup 引导流程增强

主要修改点：

1. 网络绑定扩展至 Server
   - .env.example: SERVER_HOST/VITE_SERVER_HOST 从 127.0.0.1 改为 0.0.0.0
   - server/src/app/core/config.py: 默认 app_host 从 127.0.0.1 改为 0.0.0.0

2. 启动脚本重构（重命名以区分职责）
   - server/start.sh → server/server_start.sh
   - web/start.sh → web/web_start.sh
   - 根目录 start.sh: 更新调用路径（./start.sh → ./server_start.sh, ./web_start.sh）
   - 根目录 start.sh: 新增 setup_ready() 检测函数
   - 根目录 start.sh: server_probe_host() 支持 0.0.0.0 探测转换为 127.0.0.1
   - 根目录 start.sh: start_setup_web() 新增 X_FINANCIAL_FORCE_SETUP=true

3. API URL 动态化 (web/src/services/api.js)
   - 从 localStorage 持久化读取 API Base URL
   - 新增 setRuntimeApiBaseUrl() / getRuntimeApiBaseUrl() 导出函数
   - buildUrl() 改用运行时 runtimeApiBaseUrl

4. 浏览器 Host 智能解析 (web/vite.config.js)
   - 新增 resolveBrowserApiHost(): 根据 server_host/web_host 配置决定浏览器端使用的 API Host
   - buildApiBaseUrl() 改用 resolveBrowserApiHost()
   - 新增后端启动状态管理: backendStartState / cloneBackendStartState() / updateBackendStep()
   - 后端启动分 5 步追踪: config → deps → server → health → done
   - 新增 backendStartPromise 避免重复启动

5. Setup 表单逻辑增强 (web/src/composables/useSetupView.js)
   - 新增 shouldExposeServerHost(): 判断浏览器 host 是否非本地
   - 新增 resolveInitialServerHost(): 当浏览器访问且 server_host 为本地时暴露 0.0.0.0
   - buildPayload(): 根据 shouldExposeServerHost() 自动将 127.0.0.1/localhost 转为 0.0.0.0

6. Bootstrap API 扩展 (web/src/services/bootstrap.js)
   - 新增 startBootstrapBackend(): POST /bootstrap/backend 触发后端启动
   - 新增 fetchBootstrapBackendStatus(): GET /bootstrap/backend 查询后端状态

7. Session 导航增强 (web/src/composables/useSystemState.js)
   - 新增 resolveBrowserApiBaseUrl(): 智能解析浏览器端 API Base URL
   - installSessionNavigation(): 调用 fetchBootstrapState() 同步引导状态
   - 新增 reconcileEntryRoute(): 根据引导状态协调路由
   - VITE_SERVER_HOST 默认值从 127.0.0.1 改为 0.0.0.0

8. Setup 视图增强 (web/src/views/SetupRouteView.vue)
   - 向 SetupView 传递启动进度相关 props: startupCountdownSeconds, startupLog, startupSteps, startupVisible, progressMessage

9. CSS 新增 (web/src/assets/styles/views/setup-view.css)
   - .setup-complete-progress: 进度文字样式
   - .setup-modal-backdrop: 模态框遮罩
   - .setup-startup-modal: 启动模态框容器
   - .setup-startup-head / .setup-startup-body / .setup-startup-spinner: 模态框头部/内容/加载动画
   - .setup-startup-steps / .setup-startup-step: 步骤列表及单个步骤
   - .setup-startup-step.is-running / .is-success / .is-failed: 步骤状态样式
   - .setup-startup-log: 启动日志区域

start.sh

@@ -6,6 +6,7 @@ export MSYS_NO_PATHCONV=1
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ENV_FILE="$SCRIPT_DIR/.env"
 ENV_EXAMPLE_FILE="$SCRIPT_DIR/.env.example"
+ADMIN_SECRET_FILE="$SCRIPT_DIR/server/.secrets/admin.json"
 MODE="${1:-all}"
 
 RED='\033[0;31m'
@@ -36,12 +37,27 @@ APP_DEBUG="${APP_DEBUG:-true}"
 APP_ENV="${APP_ENV:-local}"
 SERVER_RELOAD="${SERVER_RELOAD:-}"
 
+setup_ready() {
+  [ "$SETUP_COMPLETED" = "true" ] && [ -f "$ADMIN_SECRET_FILE" ]
+}
+
+server_probe_host() {
+  case "${SERVER_HOST:-127.0.0.1}" in
+    0.0.0.0|::)
+      echo "127.0.0.1"
+      ;;
+    *)
+      echo "${SERVER_HOST:-127.0.0.1}"
+      ;;
+  esac
+}
+
 server_probe_url() {
-  echo "http://${SERVER_HOST:-127.0.0.1}:${SERVER_PORT:-8000}${API_V1_PREFIX:-/api/v1}/health"
+  echo "http://$(server_probe_host):${SERVER_PORT:-8000}${API_V1_PREFIX:-/api/v1}/health"
 }
 
 server_smoke_url() {
-  echo "http://${SERVER_HOST:-127.0.0.1}:${SERVER_PORT:-8000}${API_V1_PREFIX:-/api/v1}/employees/meta"
+  echo "http://$(server_probe_host):${SERVER_PORT:-8000}${API_V1_PREFIX:-/api/v1}/employees/meta"
 }
 
 server_probe_python() {
@@ -103,7 +119,7 @@ prepare_web() {
   info "Preparing web dependencies..."
   (
     cd "$SCRIPT_DIR/web"
-    ./start.sh deps
+    ./web_start.sh deps
   )
 }
 
@@ -111,28 +127,30 @@ prepare_server() {
   info "Preparing server dependencies..."
   (
     cd "$SCRIPT_DIR/server"
-    ./start.sh deps
+    ./server_start.sh deps
   )
 }
 
 start_web() {
   prepare_web
   cd "$SCRIPT_DIR/web"
-  exec ./start.sh start
+  exec ./web_start.sh start
 }
 
 start_server() {
   prepare_server
   cd "$SCRIPT_DIR/server"
-  exec ./start.sh start
+  exec ./server_start.sh start
 }
 
 start_setup_web() {
   warn "Initial setup is not completed. Starting web only."
-  warn "Finish the setup form first. After setup is saved, run ./start.sh again to launch FastAPI as well."
+  warn "Setup requires both .env completion and server/.secrets/admin.json."
+  warn "Finish the setup form first; the web setup bridge will start FastAPI after saving."
   prepare_web
   cd "$SCRIPT_DIR/web"
-  exec ./start.sh start
+  export X_FINANCIAL_FORCE_SETUP=true
+  exec ./web_start.sh start
 }
 
 start_all() {
@@ -167,7 +185,7 @@ start_all() {
     info "Starting FastAPI server..."
     (
       cd "$SCRIPT_DIR/server"
-      ./start.sh start
+      ./server_start.sh start
     ) &
     server_pid=$!
     started_server=true
@@ -194,7 +212,7 @@ start_all() {
         fi
 
         wait "$server_pid" 2>/dev/null || true
-        error "FastAPI process exited before becoming ready. Run ./server/start.sh start directly to inspect the backend error."
+        error "FastAPI process exited before becoming ready. Run ./server/server_start.sh start directly to inspect the backend error."
       fi
 
       sleep 1
@@ -213,7 +231,7 @@ start_all() {
   prepare_web
   info "Starting web frontend..."
   cd "$SCRIPT_DIR/web"
-  ./start.sh start
+  ./web_start.sh start
 }
 
 case "$MODE" in
@@ -224,7 +242,7 @@ case "$MODE" in
     start_server
     ;;
   all)
-    if [ "$SETUP_COMPLETED" = "true" ]; then
+    if setup_ready; then
       start_all
     else
       start_setup_web