Fix setup wizard and installer for fresh-install flow

- setup_manager: fall back to update_password if admin already exists
  (installer bootstrap creates admin; wizard now updates rather than fails)
- install.sh: chown repo to SUDO_USER instead of pic user so the
  invoking operator can run make update without git safe.directory errors
- test: update mock to also stub update_password when testing total auth failure

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_setup_manager.py

@@ -252,10 +252,11 @@ def test_complete_setup_returns_error_when_create_user_fails(
         setup_manager, mock_config_manager, mock_auth_manager, tmp_path):
     mock_config_manager.get_identity.return_value = {}
     mock_auth_manager.create_user.return_value = False
+    mock_auth_manager.update_password.return_value = False
     with patch.dict(os.environ, {'DATA_DIR': str(tmp_path)}):
         result = setup_manager.complete_setup(_valid_payload())
     assert result['success'] is False
-    assert any('admin' in e.lower() or 'user' in e.lower() for e in result['errors'])
+    assert any('admin' in e.lower() or 'password' in e.lower() for e in result['errors'])
 
 
 # ── get_setup_status ──────────────────────────────────────────────────────────