fix setup redirect: check master_password_hash in saved config

Reset was not putting app in unconfigured state. _needs_setup()
was checking is_configured() but not verifying master_password_hash
exists in saved config file. Added explicit check for this key so
reset properly triggers setup form.

Also removed completed Task 26 from docs.

src/server/middleware/setup_redirect.py

@@ -81,28 +81,33 @@ class SetupRedirectMiddleware(BaseHTTPMiddleware):
     
     def _needs_setup(self) -> bool:
         """Check if the application needs initial setup.
-        
+
         Returns:
             True if setup is required, False otherwise
         """
         # Check if master password is configured
         if not auth_service.is_configured():
             return True
-        
+
         # Check if config exists and is valid
         try:
             config_service = get_config_service()
             config = config_service.load_config()
-            
+
+            # master_password_hash must exist in saved config (not just in-memory)
+            # This ensures reset actually puts app in unconfigured state
+            if not config.other.get('master_password_hash'):
+                return True
+
             # Validate the loaded config
             validation = config.validate_config()
             if not validation.valid:
                 return True
-                
+
         except (FileNotFoundError, ValueError, OSError, AttributeError):
             # If we can't load or validate config, setup is needed
             return True
-        
+
         return False
     
     def _is_unresolved_completed(self) -> bool: