CHANGELOG + REPORT: the last six PostgreSQL apps, Part F; zipline's fixture tries /api/setup first (R-624)

zipline 4's first-run route is POST /api/setup (measured on the bench 2026-09-30, v4.6.1: GET ->
{"firstSetup":true}, POST {username,password} -> 200 SUPERADMIN, the login works). The two paths the
fixture tried stay as fallbacks. No image moves in this commit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/upgrade_fixtures_box.py

@@ -769,7 +769,10 @@ class Zipline:
                 return None
         user = "drill" + secrets.token_hex(3)
         pw = "Drill-" + secrets.token_hex(10)
-        for path in ("/api/auth/register", "/api/auth/setup"):
+        # /api/setup is Zipline 4's first-run route (measured on the bench 2026-09-30, v4.6.1: GET -> {"firstSetup":true},
+        # POST {username,password} -> 200 with a SUPERADMIN, the seeded user logs in). The two others were guesses
+        # (R-624 read this app as "no route" because of them); they stay as fallbacks.
+        for path in ("/api/setup", "/api/auth/register", "/api/auth/setup"):
             rc, code, body = w.app_curl(sub, path, "-H", "Content-Type: application/json",
                                         data=json.dumps({"username": user, "password": pw}),
                                         method="POST")