docs: rewrite security/operator docs for the multi-user panel (P2)

The CSRF ADR, guide.md, architecture.md route table, the internal/backup
package comment, roadmap/dmarc-reports admin.dmarc_report_email references,
the e2e coverage summary, and the setupManager/store package comments still
described the pre-1.2.0 single-administrator panel or stale implementation
details. Closes P2 of docs/plans/code-review.md; no behaviour change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/auth/setup.go

@@ -16,8 +16,9 @@ const setupTokenTTL = 10 * time.Minute
 
 // setupManager owns the one-time administrator setup token. The token itself is
 // ephemeral (regenerated on restart or expiry) and lives only in memory; the
-// persistent "setup complete" fact is the presence of the admin row in the
-// store, so once that exists the token is gone for good (security.md).
+// persistent "setup complete" fact is the presence of any row in the store's
+// users table (`store.UserExists`), so once the first global administrator is
+// created the token is gone for good (security.md).
 type setupManager struct {
 	store     *store.Store
 	hostname  string