fix(v2): UX polish, spec compliance, type safety, race-condition fixes

- Auto-create WebhookToken for new users (first-user and admin-created),
  so setup wizard step 3 immediately has a valid secret to display
- Setup wizard: load webhook secret on step 3 entry (not only on AWS save),
  so skipping AWS setup still shows correct webhook info
- Admin panel: add Edit modal with username and password change for any user
  (spec: 'Edit username or password of any user')
- Webhook handler: only post 'no config' comment on opened/reopened actions,
  not on synchronize or closed — prevents spam on sync events
- deploy.ts: clear stale abort signal at start of runDeploy so a signal meant
  to cancel the previous job cannot accidentally abort the new one
- routes/auth.ts: fix sameSite cookie case to lowercase 'lax' per TypeScript
- Add node-cron type declaration to silence TS7016 for that import
- SPEC.md: fix ec2:ImportKeyPair → ec2:CreateKeyPair (code uses CreateKeyPair)
- example.env: improve comments, add NODE_ENV, add key generation hints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/auth.ts

@@ -42,7 +42,7 @@ export async function loginHandler(ctr: any) {
       httpOnly: true,
       expires: new Date(Date.now() + COOKIE_MAX_AGE_MS),
       path: "/",
-      sameSite: "Lax",
+      sameSite: "lax",
     }),
   );
 
@@ -116,6 +116,10 @@ export async function firstUserHandler(ctr: any) {
     data: { username, passwordHash: hash, isAdmin: true, isFounder: true },
   });
 
+  // Auto-create a webhook token so it's immediately available in the setup wizard
+  const webhookSecret = randomBytes(32).toString("hex");
+  await prisma.webhookToken.create({ data: { userId: user.id, token: webhookSecret } });
+
   const sessionHash = randomBytes(32).toString("hex");
   await prisma.session.create({ data: { hash: sessionHash, userId: user.id } });
 
@@ -125,7 +129,7 @@ export async function firstUserHandler(ctr: any) {
       httpOnly: true,
       expires: new Date(Date.now() + COOKIE_MAX_AGE_MS),
       path: "/",
-      sameSite: "Lax",
+      sameSite: "lax",
     }),
   );