Fix all 7 launch blockers from security/QA review

SEC-16: Add frontend ports mapping (80:80) to docker-compose.yml
UI-01:  Add routes for Welcome, SettingsIntegrations, MealPlan in App.jsx
SEC-01: Remove traceback leak from auth error responses
SEC-02: Fix require_admin to use is_admin column (was undefined ADMIN_USERNAME)
SEC-03: Add API_TOKEN auth for MCP connector -> backend communication
SEC-04: OAuth state now uses signed JWT tokens (was raw user UUID)
OS-01:  First registered user gets admin immediately during registration

10 files changed, 97 insertions(+), 25 deletions(-)

setup.sh

@@ -7,13 +7,20 @@ if [ -f .env ]; then
 fi
 
 SECRET=$(openssl rand -hex 32)
+TOKEN=$(openssl rand -hex 32)
 cp .env.example .env
-sed -i "s/^SECRET_KEY=.*/SECRET_KEY=${SECRET}/" .env
+sed -i.bak "s/^SECRET_KEY=.*/SECRET_KEY=${SECRET}/" .env
+sed -i.bak "s/^API_TOKEN=.*/API_TOKEN=${TOKEN}/" .env
+rm -f .env.bak
 
-echo "✅ .env created with random SECRET_KEY"
+echo "✅ .env created with random SECRET_KEY and API_TOKEN"
 echo ""
 echo "Next steps:"
 echo "  docker compose up -d"
 echo "  Open http://localhost"
 echo "  Register your account"
 echo "  Configure integrations via Settings or your AI agent"
+echo ""
+echo "MCP agent connection:"
+echo "  URL: http://localhost:3001/sse"
+echo "  Header: Authorization: Bearer ${TOKEN}"