fix(setup): deploy the system agent once /setup has created the admin (#3237)

[obasilakis]

Closes #3237.

Problem

trinity-system's only deploy attempt runs at backend startup (main.py::_init_docker_and_system_agent). On a fresh install that is before /setup creates the admin that owns it, so it fails with Admin user 'admin' not found, and nothing retries until the backend restarts. Every one-click / marketplace install hits this.

Fix

routers/setup.py schedules _deploy_system_agent as a background task right after the first-run seed pass (Cornelius + starter agents come first). It wraps system_agent_service.ensure_deployed() and never raises: setup has already succeeded, and the next backend start retries. ensure_deployed is idempotent, so the startup call stays a no-op afterwards.

Verification

• tests/unit/test_3237_system_agent_after_setup.py: the deploy is scheduled after the seed pass; a raising ensure_deployed does not propagate; the wrapper calls it. All three failed before the fix (no attribute '_deploy_system_agent').
• Setup-related suites (operator profile, ent#124 seed, bug(security): fresh install leaves setup_completed=false with a real admin — unauthenticated /api/setup/admin-password overwrites the admin password #2381, feat: AWS one-click — Marketplace free AMI (Launch from Website) + CloudFormation Launch Stack link #3004) and the structural guards (refactor: split oversized backend routers & services (settings, public, agent crud, git, agent_client) #1028, refactor(auth): consolidate duplicated auth/dependency patterns behind factories (INV-8, split from #654) #1310, SEC: User and Agent Enumeration via differential API responses #186, models-centralized, test placement lint) pass.
• Live, on an AWS instance from the v1.0.0-aws.2 AMI: removed agent-trinity-system, ran the task inside the backend → System agent after setup: created, container running with NanoCpus=2000000000 (the bug: trinity-system agent can never be created on hosts with fewer than 4 CPUs — template cpu:"4" passed to Docker unclamped #2318 cap).

🤖 Generated with Claude Code

[vybe]

merge-train (2026-10-06): closing as superseded — #3261 (same fix for #3237, via a lazy-import _deploy_system_agent_after_setup background task) landed on dev this morning at 7787712, and this branch now conflicts with it on the add/add test file. Nothing from here is lost; if there is a behaviour in this PR that #3261 does not cover, reopen with that delta.