- dev-bypass path: DB lookup for users.isAdmin (T-10-05 bypass skips OIDC not DB) - OIDC path: same resolveAdminAndSetupStatus helper after upsertUser - needsProviderSetup: true when no member_credentials row, false when one exists - no /api/me/credential POST added here (Plan 03)