fix(installer): enforce same-session installation lock

[victorsteele]

Summary

Fixes the verified v5.1.0 first-run installer same-session lock bypass.

Fix

• Blocks installed-state access to installer steps 1-8.
• Allows the installation-success screen only once.
• Blocks replay of the success screen.
• Clears completion-session data before admin-login redirect.
• Preserves installer locking for new and private browser sessions.

Compatibility

• No database schema changes.
• No business-logic changes.
• No license generation or validation changes.
• No API contract changes.
• No route or admin UI changes.

Validation

• PHP syntax checks: PASS
• Compatibility regression: PASS
• Security smoke test: PASS
• Installer smoke test: PASS
• Fresh DEMO installation: PASS
• Same-session installer lock: PASS
• Private-session installer lock: PASS

Pending release-validation item

• Fresh production installation with Demo Data unchecked