Add the coordinator setup wizard for self-provisioned databases

PLAN.md

@@ -1004,18 +1004,20 @@ schema, and a `setup` command walks the operator through the remaining
 environment (database creation, secrets, admin account).
 
 **Depends on:** the Go coordinator and the release build pipeline. Step 1
-(embedded migrations, `AUTO_MIGRATE`) is implemented; steps 2–3 below are
-the remaining work.
+(embedded migrations, `AUTO_MIGRATE`) and step 2 (the `coordinator setup`
+wizard: database reachability and creation, schema migration, `.env` with a
+generated `JWT_SECRET`, readiness summary) are implemented; step 3 — a fully
+embedded userservice — is the remaining work.
 
 **Acceptance criteria:**
 
 - the binary embeds the migrations and applies pending ones on startup by
   default (`AUTO_MIGRATE=false` opts out for managed databases); applying is
   idempotent and safe under concurrent starts;
-- `coordinator setup` (interactive, then non-interactive with flags) checks
+- `coordinator setup` (interactive, then non-interactive with `--yes`) checks
   database reachability, offers to create the role/database when credentials
   allow it, applies migrations, writes a `.env` with a generated `JWT_SECRET`
-  and storage path, and verifies readiness with `/health`;
+  and storage path, and prints exact next steps;
 - `coordinator --version` and the setup output agree on the release build;
 - the wizard explains what it cannot do itself: running PostgreSQL and the
   userservice, with concrete commands (docker compose, systemd) to finish;
@@ -1164,10 +1166,9 @@ Do not start these before CTX-12 is accepted.
 - Add shard caching and content-addressed input deduplication.
 - Add job priority and fair scheduling.
 - Add a CLI for submitting and monitoring remote jobs.
-- Implement CTX-17 steps 2–3: the interactive `coordinator setup` wizard
-  (database creation, `.env` generation, admin seeding) and, later, a fully
-  embedded userservice (`coordinator userservice` subcommand) so one binary
-  can serve the whole platform without containers.
+- Implement CTX-17 step 3: a fully embedded userservice
+  (`coordinator userservice` subcommand) so one binary can serve the whole
+  platform without containers.
 - Replace PostgreSQL with an embedded SQLite backend for fully self-contained
   single-binary deployments (large storage-layer change; postgres row locks,
   transactions, and integration tests must be re-derived).