Refine admin/setup repository contracts

[sigilabcodex]

This PR continues the repository-first persistence transition by reducing AppData-era coupling in admin/setup flows.

Highlights:

• Adds targeted repository methods for users, instance/session state, and customer imports
• Refactors admin/setup actions away from full snapshot replacement patterns
• Keeps JSON and hybrid PostgreSQL persistence paths aligned
• Preserves current bootstrap/setup behavior
• Reduces broad AppData mutation in identity/session/module flows

This is a stabilization/refinement PR, not a feature expansion.