feat(12-01): stub setupGuard.ts + setup.ts router — Wave-0 import targets

- Add apps/api/src/lib/setupGuard.ts exporting isSetupLocked(): Promise<boolean>
  (Wave-0 stub returns false; real DB impl ships in Plan 02)
  Doc comment enforces D-10: re-evaluate fresh on every call, never module-cache
- Add apps/api/src/routes/setup.ts exporting setupRouter = new Hono()
  (empty router; handlers + index.ts mount added in Plan 02)
  Doc comment notes pre-auth surface position — before /api/* OIDC chain

apps/api/src/routes/setup.ts

@@ -0,0 +1,17 @@
+/**
+ * setup.ts — /api/setup/* route surface (Phase 12 initial-setup wizard).
+ *
+ * Mounted in index.ts: app.route('/api/setup', setupRouter)
+ * Mount position: BEFORE app.use('/api/*', devAuthBypass()) so the wizard
+ * is reachable pre-authentication — same pre-auth surface as /health (T-01-03).
+ *
+ * Wave-0 stub (Plan 01): empty router — all handlers are added in Plan 02.
+ * Plan 02 owns the index.ts mount as well, to keep file-ownership clean.
+ *
+ * Security note: every handler added in Plan 02 MUST call isSetupLocked() as
+ * its first statement and return 423 if locked (SETUP-04 / Pitfall 8 / D-10).
+ */
+
+import { Hono } from 'hono';
+
+export const setupRouter = new Hono();