Summary

The setup status endpoint determines `needs_admin` by checking `user_count == 0`. This works because the only way to create users in the current flow is through the admin setup endpoint. However, it would be more robust to check for the existence of an admin-role user specifically.

Current behavior

`needs_admin = (await persistence.users.count()) == 0`

Expected behavior

Check for admin role: `needs_admin = (await persistence.users.count_by_role("ceo")) == 0`

This requires adding a `count_by_role` method to the user repository protocol and implementations.

Context

Found during PR #584 review. Deferred because it requires changes to the repository protocol, SQLite implementation, and fake implementation.