Eliminate direct app.state access from routers

backend/app/routers/setup.py

@@ -13,6 +13,7 @@ from fastapi import APIRouter, HTTPException, status
 from app.dependencies import AppDep, DbDep, SettingsDep
 from app.models.setup import SetupRequest, SetupResponse, SetupStatusResponse, SetupTimezoneResponse
 from app.services import setup_service
+from app.utils.runtime_state import update_app_settings
 from app.utils.setup_state import is_setup_complete_cached, set_setup_complete_cache
 
 log: structlog.stdlib.BoundLogger = structlog.get_logger()
@@ -75,13 +76,12 @@ async def post_setup(
         session_duration_minutes=body.session_duration_minutes,
     )
     set_setup_complete_cache(app, True)
-    app.state.settings = app.state.settings.model_copy(
-        update={
-            "database_path": body.database_path,
-            "fail2ban_socket": body.fail2ban_socket,
-            "timezone": body.timezone,
-            "session_duration_minutes": body.session_duration_minutes,
-        }
+    update_app_settings(
+        app,
+        database_path=body.database_path,
+        fail2ban_socket=body.fail2ban_socket,
+        timezone=body.timezone,
+        session_duration_minutes=body.session_duration_minutes,
     )
     return SetupResponse()