AI Implementation feature(821): First-Start Create Admin Modal (#2)

backend/src/common/errors/error-codes.ts

@@ -9,6 +9,7 @@ export const ERROR_CODES = {
   RATE_LIMITED: 'RATE_LIMITED',
   CSRF_INVALID: 'CSRF_INVALID',
   WEAK_PASSWORD: 'WEAK_PASSWORD',
+  USERNAME_TAKEN: 'USERNAME_TAKEN',
   INVALID_CREDENTIALS: 'INVALID_CREDENTIALS',
   TOKEN_REVOKED: 'TOKEN_REVOKED',
   THEME_INVALID: 'THEME_INVALID',

backend/src/common/middleware/csrf.middleware.ts

@@ -8,7 +8,11 @@ import { ERROR_CODES } from '../errors/error-codes';
 const UNSAFE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 const COOKIE_NAME = 'csrf';
 const HEADER_NAME = 'x-csrf-token';
-const SKIP_PATH_PREFIXES = ['/api/v1/auth/register-first-admin', '/api/v1/auth/login'];
+const SKIP_PATH_PREFIXES = [
+  '/api/v1/auth/register-first-admin',
+  '/api/v1/auth/login',
+  '/api/v1/setup/create-admin',
+];
 
 function isSkipped(path: string): boolean {
   return SKIP_PATH_PREFIXES.some((p) => path === p || path.startsWith(p + '/'));