Set umbral_name=username on all user creation paths

Admin create, first-user setup, and registration endpoints were
missing umbral_name assignment, causing NOT NULL constraint failures
when creating new users after migration 039.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/routers/admin.py

@@ -209,6 +209,7 @@ async def create_user(
 
     new_user = User(
         username=data.username,
+        umbral_name=data.username,
         password_hash=hash_password(data.password),
         role=data.role,
         email=email,

backend/app/routers/auth.py

@@ -288,6 +288,7 @@ async def setup(
     password_hash = hash_password(data.password)
     new_user = User(
         username=data.username,
+        umbral_name=data.username,
         password_hash=password_hash,
         role="admin",
         last_password_change_at=datetime.now(),
@@ -454,6 +455,7 @@ async def register(
     # SEC-01: Explicit field assignment — never **data.model_dump()
     new_user = User(
         username=data.username,
+        umbral_name=data.username,
         password_hash=password_hash,
         role="standard",
         email=data.email,