fix setup redirect: check master_password_hash in saved config

Reset was not putting app in unconfigured state. _needs_setup()
was checking is_configured() but not verifying master_password_hash
exists in saved config file. Added explicit check for this key so
reset properly triggers setup form.

Also removed completed Task 26 from docs.

Docs/tasks.md

@@ -1,17 +1,3 @@
-## Task 26: UI Setup Flow - Setup Form Validation Empty Password
-
-**Suite:** `Robot.Ui.Setup Flow`  
-**Test:** `Setup Form Validation Empty Password`  
-**Result:** FAIL  
-**Error:** `TimeoutError: locator.waitFor: Timeout 5000ms exceeded. waiting for locator('id=setup-form') to be visible`
-
-**Instructions:**
-- Same root cause as Task 22: the setup form is not visible.
-- Fix the suite setup so the app is in an unconfigured state before each setup flow test.
-- Ensure `#setup-form` is rendered when navigating to the setup page.
-
----
-
 ## Task 27: UI Setup Flow - Setup Form Validation Mismatched Passwords
 
 **Suite:** `Robot.Ui.Setup Flow`  

src/server/middleware/setup_redirect.py

@@ -94,6 +94,11 @@ class SetupRedirectMiddleware(BaseHTTPMiddleware):
             config_service = get_config_service()
             config = config_service.load_config()
 
+            # master_password_hash must exist in saved config (not just in-memory)
+            # This ensures reset actually puts app in unconfigured state
+            if not config.other.get('master_password_hash'):
+                return True
+
             # Validate the loaded config
             validation = config.validate_config()
             if not validation.valid: