fix: prevent setup restart bypass

apps/mobile/android/app/src/main/java/cloud/molberg/hermesmobile/onboarding/SetupWizardModels.kt

@@ -262,7 +262,11 @@ object SetupWizardReducer {
             hasLegacyConfiguration &&
             existing
         return SetupGateResolution(
-            entry = entry,
+            entry = if (setupVersion >= CURRENT_SETUP_VERSION || migrateExistingUser) {
+                entry
+            } else {
+                SetupEntry.Mandatory(firstRun())
+            },
             migrateExistingUser = migrateExistingUser
         )
     }

apps/mobile/android/app/src/test/java/cloud/molberg/hermesmobile/onboarding/SetupWizardReducerTest.kt

@@ -214,7 +214,22 @@ class SetupWizardReducerTest {
     }
 
     @Test
-    fun currentOrNonLegacyExistingConfigDoesNotRequestMigration() {
+    fun failedFirstRunSavedProfileCannotSkipMandatorySetupAfterRestart() {
+        val resolution = SetupWizardReducer.resolveEntry(
+            config = ConnectionConfig(
+                remoteUrl = REMOTE,
+                authMode = ConnectionAuthMode.None
+            ),
+            setupVersion = 0,
+            hasLegacyConfiguration = false
+        )
+
+        assertTrue(resolution.entry is SetupEntry.Mandatory)
+        assertFalse(resolution.migrateExistingUser)
+    }
+
+    @Test
+    fun completedExistingConfigSkipsWithoutRequestingMigration() {
         val config = ConnectionConfig(
             remoteUrl = REMOTE,
             authMode = ConnectionAuthMode.None
@@ -225,16 +240,9 @@ class SetupWizardReducerTest {
             setupVersion = SetupWizardReducer.CURRENT_SETUP_VERSION,
             hasLegacyConfiguration = true
         )
-        val nonLegacy = SetupWizardReducer.resolveEntry(
-            config = config,
-            setupVersion = 0,
-            hasLegacyConfiguration = false
-        )
 
         assertTrue(current.entry is SetupEntry.ExistingConfiguration)
         assertFalse(current.migrateExistingUser)
-        assertTrue(nonLegacy.entry is SetupEntry.ExistingConfiguration)
-        assertFalse(nonLegacy.migrateExistingUser)
     }
 
     @Test