request-validation: skip setup endpoints (createAdminUser) by default — only valid on fresh cluster

Problem

POST /v2/setup/user (createAdminUser) only accepts traffic on a fresh cluster. Once the cluster has been initialised, all calls return 403 FORBIDDEN, including the negative-test calls that send malformed bodies. The negative tests therefore fail not because of server misbehaviour but because the endpoint is no longer accepting requests.

3 failing tests in the current suite:

• createAdminUser - Missing password → 403
• createAdminUser - Missing username → 403
• createAdminUser - Missing combo username,password → 403

Proposal

Emit setup-endpoint scenarios behind an opt-in flag (e.g. --include-setup / INCLUDE_SETUP=1), default off. Setup endpoints have a one-shot semantic that doesn't mesh with the "run repeatedly against the same cluster" testing model the rest of the suite assumes.

Detection: any operation tagged with the setup tag (or path matching /v2/setup/**) is excluded by default.

Acceptance criteria

• Default emission contains zero createAdminUser (and any other /v2/setup/**) scenarios.
• --include-setup re-enables them.
• README documents the flag and the "fresh cluster only" requirement when set.

References

• Triage: #119 (Class 5, 3 failures)