fix(12): WR-01 delete orphaned user row on re-select 503 path in /credential

After $returningId() insert, if the re-select returns null the handler
returned 503 without deleting the just-inserted user row, leaving an
unclaimed admin row with no credential. Delete before returning 503 to
mirror the cleanup already present in the catch block.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/routes/setup.ts

@@ -275,6 +275,9 @@ setupRouter.post('/credential', zValidator('json', credentialSchema, noEchoHook)
     .limit(1);
 
   if (!localUser) {
+    // Clean up the just-inserted user row to avoid an orphaned unclaimed admin
+    // (WR-01: the catch block below does not cover this early-return path).
+    await db.delete(users).where(eq(users.id, inserted.id));
     return c.json({ error: 'Service unavailable' }, 503);
   }