fix(setup): deploy the system agent once /setup creates the admin (#3237)

[dolho]

Summary

• On a browser-claimed install (DigitalOcean / AWS one-click, the hosted script) the only system-agent deploy ran at backend boot, before /setup had created the admin, and failed with Admin user 'admin' not found. Nothing retried it, so trinity-system stayed absent until a backend restart.
• POST /api/setup/admin-password now schedules _deploy_system_agent_after_setup as a background task once the admin row exists. It calls the same idempotent system_agent_service.ensure_deployed() as boot, so the next restart is a no-op.
• It runs before ensure_first_run_seeded, which is the boot order. The seeder hosts its failure alerts on trinity-system, and running the two in sequence keeps the system agent and Cornelius from racing for an SSH port.
• The task never raises, because Starlette runs background tasks in sequence and a raise would also skip the seed and the operator intake. It skips when there is no Docker client, the same as the boot guard.

Changes

• src/backend/routers/setup.py: the helper and the add_task call. Imports are lazy, which keeps the router's import isolation.
• tests/unit/test_3237_system_agent_after_setup.py (new) and its tests/registry.json entry.
• docs/memory/feature-flows/internal-system-agent.md: the second deploy trigger.

Trade-off

On a fresh install, Cornelius seeding now starts after the system-agent create, roughly 20–90s later (recreate plus readiness wait). Setup's response is unaffected because both are background tasks.

Out of scope

SYSTEM_AGENT_OWNER = "admin" is hard-coded, while /setup creates admin_username(), which honours ADMIN_USERNAME. With ADMIN_USERNAME set to anything else, the create still fails after this fix. That is a separate bug and gets its own issue.

Test Plan

• cd tests && pytest unit/test_3237_system_agent_after_setup.py: 5 passed. Before the fix, 4 of them failed (the refused-setup case passes either way).
• Every unit test that touches the setup router (bug(security): fresh install leaves setup_completed=false with a real admin — unauthenticated /api/setup/admin-password overwrites the admin password #2381, feat: AWS one-click — Marketplace free AMI (Launch from Website) + CloudFormation Launch Stack link #3004, ent#580, operator profile, route order/census, bug: First-time setup token silently lost — print() block-buffered, breaks fresh installs #858), shuffled with --randomly-seed=12345: 118 passed. With the seeding and lifespan-phase suites: 220 passed.
• Manual, on a local fresh install (empty data volume, blank ADMIN_PASSWORD):
  • dev code: boot logs create_failed - Admin user 'admin' not found; after /setup, no agent-trinity-system for 2 minutes.
  • This branch: same boot failure; /setup at 08:56:37, agent-trinity-system created at 08:56:38 (routers.setup: "System agent after setup: created"), backend restart count 0. /api/system-agent/status: running, owner admin, is_system: true, base image current. First-run seeding started right after it.

Fixes #3237

🤖 Generated with Claude Code

[vybe]

merge-train: batch validated on train/20261006-0833 (#3266)