add admin account recovery via setup secret

When email isn't configured, the login page now hides the magic link
form and shows a recovery link. The /recover page logs the setup secret
to server logs and lets the admin reset their password with it.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/berrypod/accounts.ex

@@ -69,6 +69,13 @@ defmodule Berrypod.Accounts do
     Repo.exists?(User)
   end
 
+  @doc """
+  Returns the first (and typically only) admin user, or nil.
+  """
+  def get_first_admin do
+    Repo.one(from u in User, limit: 1)
+  end
+
   ## User registration
 
   @doc """