feat(setup): one-command developer setup via npm run setup

[parth0025]

Summary

Adds npm run setup — an additive one-command developer setup that goes from a fresh git clone to a working login screen with zero manual steps. Non-technical contributors can now contribute without learning the 9-step installation wizard.

The orchestrator (scripts/dev.js) installs deps, builds the wizard UI, bootstraps .env, starts the backend + frontend, completes the installation wizard headlessly via the existing API, creates a default admin account, and opens the login page.

What's new

• scripts/dev.js — orchestrator (~540 lines, no extra runtime deps). HTTP-based wizard auto-completion, MongoDB probe with retry, defensive .env patching, credentials banner, graceful fallback chain.
• nodemon.json — explicit watch list (server-side dirs / .js only). Fixes the root cause of the "wizard reloads on MongoDB step" bug: installationSteps.json writes were triggering full backend restarts mid-request.
• package.json — three new scripts (setup, dev, setup:reset) and nodemon added to devDependencies.

Wizard fixes (back-compat preserving)

• Modules/CheckInstallStep/controller.js:

  • isDoItLater: true support added for step 4 (Firebase) and step 6 (SMTP), mirroring the existing AI (step 5) skip pattern. Both steps remain mandatory unless the caller opts in.
  • Defensive APIURL fallback at module load — was crashing the backend on a fresh clone with TypeError: Cannot read properties of undefined (reading 'substring') when .env hadn't been populated yet.

• .env.example — SERVICE_FILE corrected from ../firebase-adminsdk.json (which tripped the BUG-036 path-traversal guard and blocked the Firebase wizard step) to ./firebase-adminsdk.json. Added Quick Start comment block at the top.

Nothing existing changes

• npm start, npm run nodemon, npm run basic-install, the interactive wizard, and the documented manual setup paths are all untouched.
• New scripts never run automatically; users must invoke them explicitly.
• Fallback chain at every failure point (MongoDB unreachable / auto-setup error / --manual flag) opens the interactive wizard UI so the user is never left in an unrecoverable state.

Test plan

• Fresh clone → npm run setup → login page in ~2 min (with local MongoDB)
• Re-run after success → detects step 7 + step 8 done, opens login page without re-init
• MongoDB unreachable → 3 retries, then opens wizard UI with Docker/install instructions
• --manual flag → skips auto-setup, opens wizard UI
• --no-open flag → completes setup without launching a browser
• Pre-existing jest suite still passes (19/20 — the failing imageGuard.test.js > getLimits respects env overrides was already failing on staging before this change; tracked separately)
• Syntax check on dev.js and controller.js
• Isolated logic tests pass: WEBURL fallback, readEnvValue regex, MongoDB URL regex, isInstallationComplete detection

Custom admin credentials (optional)

SETUP_ADMIN_EMAIL=you@example.com SETUP_ADMIN_PASSWORD=secret npm run setup

Other overrides: SETUP_ADMIN_FIRST, SETUP_ADMIN_LAST, SETUP_COMPANY, SETUP_PHONE, SETUP_COUNTRY, SETUP_CITY, SETUP_STATE.

🤖 Generated with Claude Code