test(12-01): Wave-0 test scaffolds — setup.test.ts + user.test.ts (RED)

- Add apps/api/tests/routes/setup.test.ts with it.todo() scaffolds for:
  SETUP-01 (GET /api/setup/status), SETUP-02 (validate/vapid + validate/oidc),
  SETUP-01 (POST /api/setup/credential), SETUP-04 (POST /api/setup/complete
  × 2 → first 200, second 423), D-10 effective-config 423 guard.
  All 15 cases RED (it.todo) so Plan 02 implements against real failing tests.
- Extend apps/api/tests/auth/user.test.ts with D-08 first-login-claims describe
  block (5 it.todo() cases): unclaimed user bind, is_admin preservation,
  setup_complete=false fallthrough, no unclaimed fallthrough, no email lookup (D-10)
- Suite collects clean: 375 passed | 20 todo — no import errors

apps/api/tests/auth/user.test.ts

@@ -399,3 +399,42 @@ describe('upsertUser', () => {
     expect(mockDb.select).toHaveBeenCalledTimes(1);
   });
 });
+
+// ── Plan 12-01: D-08 first-login-claims scaffold (Wave-0 RED placeholders) ──
+//
+// These tests cover the first-login-claims flow that Plan 12-02 implements in
+// upsertUser. When setup_complete='true', the first OIDC login from an unknown
+// iss+sub should "claim" the single unclaimed local user row (oidcIss IS NULL AND
+// claimed=false), binding oidcIss/oidcSub and setting claimed=true.
+//
+// Key constraints (D-08 / D-10):
+//   - NEVER look up by email — only oidcIss+oidcSub and claimed=false
+//   - Preserve is_admin on the claimed row (operator pre-set it in the wizard)
+//   - Only claim when setup_complete='true' in app_config
+
+describe('upsertUser — D-08 first-login-claims (Wave-0 scaffold, Plan 12-02 implements)', () => {
+  it.todo(
+    'when setup_complete is true and an unclaimed local user exists (oidcIss IS NULL, claimed=false), ' +
+      'binds oidcIss+oidcSub+claimed=true and returns the updated row',
+  );
+
+  it.todo(
+    'when setup_complete is true and claimed user row is found, ' +
+      'preserves is_admin on the claimed user (admin flag not overwritten)',
+  );
+
+  it.todo(
+    'when setup_complete is false (or unset), does NOT check for unclaimed rows — ' +
+      'falls through to normal insert path',
+  );
+
+  it.todo(
+    'when setup_complete is true but NO unclaimed local user exists, ' +
+      'falls through to normal insert path (new user row created)',
+  );
+
+  it.todo(
+    'first-login-claims NEVER uses email as a lookup key — ' +
+      'identity is strictly oidcIss IS NULL AND claimed=false (D-10)',
+  );
+});