rework setup wizard into phased flow

phase 1 (no admin): show only the email form
phase 2 (admin created, not logged in): "check your inbox" gate with
  "wrong email? start over" link that deletes the unconfirmed user
phase 3 (logged in via magic link): show provider + stripe steps

removes the confusing redirect to /users/log-in after account creation.
users now stay on /setup throughout the entire setup process.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/berrypod/accounts.ex

@@ -69,6 +69,36 @@ defmodule Berrypod.Accounts do
     Repo.exists?(User)
   end
 
+  @doc """
+  Returns the email of the admin user, or nil if no user exists.
+  """
+  def admin_email do
+    Repo.one(from u in User, select: u.email, limit: 1)
+  end
+
+  @doc """
+  Returns the unconfirmed admin user, or nil.
+
+  Used by the setup wizard to allow "start over" before the magic link is clicked.
+  """
+  def get_unconfirmed_admin do
+    Repo.one(from u in User, where: is_nil(u.confirmed_at), limit: 1)
+  end
+
+  @doc """
+  Deletes an unconfirmed user (confirmed_at is nil).
+
+  Returns `{:error, :already_confirmed}` if the user has already confirmed,
+  preventing accidental deletion of an active admin account.
+  """
+  def delete_unconfirmed_user(%User{confirmed_at: nil} = user) do
+    Repo.delete(user)
+  end
+
+  def delete_unconfirmed_user(%User{}) do
+    {:error, :already_confirmed}
+  end
+
   ## User registration
 
   @doc """