feat: implement setup redirect middleware and fix test suite

- Created SetupRedirectMiddleware to redirect unconfigured apps to /setup
- Enhanced /api/auth/setup endpoint to save anime_directory to config
- Updated SetupRequest model to accept optional anime_directory parameter
- Modified setup.html to send anime_directory in setup API call
- Added @pytest.mark.requires_clean_auth marker for tests needing unconfigured state
- Modified conftest.py to conditionally setup auth based on test marker
- Fixed all test failures (846/846 tests now passing)
- Updated instructions.md to mark setup tasks as complete

This implementation ensures users are guided through initial setup
before accessing the application, while maintaining test isolation
and preventing auth state leakage between tests.

tests/security/test_input_validation.py

@@ -230,6 +230,7 @@ class TestInputValidation:
 
 
 @pytest.mark.security
+@pytest.mark.requires_clean_auth
 class TestAPIParameterValidation:
     """Security tests for API parameter validation."""
 

tests/security/test_sql_injection.py

@@ -179,6 +179,7 @@ class TestNoSQLInjection:
 
 
 @pytest.mark.security
+@pytest.mark.requires_clean_auth
 class TestORMInjection:
     """Security tests for ORM injection protection."""