First-Run Production Flow

Parent: #762 | Priority escalation: was prio:low, now critical path for v0.5.0

This issue covers everything needed for a user to: start Docker containers -> log in -> complete setup wizard -> see a working dashboard with real agent data.

Gap 1: Login Page (was the original scope)

LoginPage.tsx is a 7-line stub -- just the word "Login" centered on screen. Needs:

• Branded login form matching design system (dark theme, logo/wordmark, accent colors)
• First-run detection: if GET /setup/status returns needs_admin: true, show admin account creation form (POST /auth/setup) instead of login
• Normal login form calling POST /auth/login, storing JWT via auth store
• Error messaging for failed login, lockout handling (hook into useLoginLockout)
• Redirect to /setup if setup not complete, / (dashboard) if authenticated + setup done

Gap 2: Agent Bootstrap from Config

After setup wizard saves agents via POST /setup/company (template path) or POST /setup/agent (blank path), the agents are persisted in SettingsService as config. But nobody converts them to runtime AgentIdentity instances registered in AgentRegistryService.

The only existing registration path is HiringService.instantiate_agent() which requires manual hiring approval -- not suitable for bootstrap.

Needed: A bootstrap routine (in lifecycle.py _safe_startup() or auto_wire.py) that:

1. Calls config_resolver.get_agents() to load persisted agent configs
2. For each AgentConfig, creates an AgentIdentity
3. Registers it in AgentRegistryService
4. This must run both on app startup (for restarts after setup) AND be triggerable from setup completion

Gap 3: Engine Re-initialization After Setup

TaskEngine.start() runs during app startup (before setup exists). After setup completes:

• The engine has already initialized with an empty agent registry
• New provider configs aren't picked up by the running engine
• Needed: A re-init hook on POST /setup/complete that reloads agent registry + provider configs into the running engine, or a signal for the engine to refresh its state

Deliverables

• Branded login page with first-run admin creation flow
• Agent bootstrap routine (startup + post-setup trigger)
• Engine re-initialization on setup completion
• Unit tests for login flow
• Unit tests for bootstrap routine
• Integration test: full first-run flow (admin create -> login -> setup -> agents registered -> dashboard data available)

Acceptance Criteria

A user can:

1. docker compose -f docker/compose.yml up -d
2. Visit http://localhost:3000 -- sees branded login page
3. First visit: create admin account, get redirected to setup wizard
4. Complete wizard (pick template, configure provider)
5. Land on dashboard with agents listed, departments shown, budget initialized
6. Agents are registered in runtime and ready to accept tasks

Blocked by

• feat: design tokens and core UI components #775 (design tokens -- needed for branding) -- VERIFY: may already be merged

Related

• fix: align frontend AgentConfig type with actual backend API response shape #878 (align frontend AgentConfig type with backend)
• fix: align frontend DepartmentHealth type with backend model #892 (align frontend DepartmentHealth type with backend)