Add green-bean inventory and cupping features

Ports inventory management and SCA-style cupping scoring from
hope_roaster: lot tracking with audit-logged consumption, cupping
sessions with server-authoritative scoring and a live radar chart,
and links from the planner (draw-from-lot, open-cupping-session).

Also fixes the Blend/Single-origin toggle layout, replaces tooltips
with an in-context "why" teaching layer, and stages the planner UI
into pre-roast vs. post-roast phases.

public/js/setup.js

@@ -0,0 +1,37 @@
+const form = document.querySelector("#setup-form");
+const message = document.querySelector("#message");
+
+function showError(text) {
+	message.textContent = text;
+	message.className = "auth-message error";
+}
+
+form.addEventListener("submit", async (event) => {
+	event.preventDefault();
+	const submitButton = form.querySelector("button[type=submit]");
+	submitButton.disabled = true;
+	message.textContent = "";
+	try {
+		const response = await fetch("/api/auth/bootstrap", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(Object.fromEntries(new FormData(form))),
+		});
+		const body = await response.json();
+		if (!response.ok) {
+			showError(
+				{
+					bootstrap_used: "The administrator account already exists.",
+					invalid_setup_token: "That setup token is incorrect.",
+					bootstrap_unavailable: "Setup is not available in this deployment.",
+				}[body.code] || body.error || "Could not create the administrator.",
+			);
+			return;
+		}
+		location.assign("/app");
+	} catch {
+		showError("Could not reach the server. Check your connection and try again.");
+	} finally {
+		submitButton.disabled = false;
+	}
+});