feat: add VIP roster tracking and accountability reports

- Add isRosterOnly flag for VIPs who attend but don't need transportation
- Add VIP contact fields (phone, email) and emergency contact info
- Create Reports page under Admin menu with Accountability Roster
- Report shows all VIPs (active + roster-only) with contact/emergency info
- Export to CSV functionality for emergency preparedness
- VIP list filters roster-only by default with toggle to show
- VIP form includes collapsible contact/emergency section
- Fix first-user race condition with Serializable transaction
- Remove Traccar hardcoded default credentials
- Add feature flags endpoint for optional services

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/src/gps/traccar-client.service.ts

@@ -53,8 +53,8 @@ export class TraccarClientService implements OnModuleInit {
   private client: AxiosInstance;
   private readonly baseUrl: string;
   private sessionCookie: string | null = null;
-  private adminUser: string = 'admin';
-  private adminPassword: string = 'admin';
+  private adminUser: string = '';
+  private adminPassword: string = '';
 
   constructor(private configService: ConfigService) {
     this.baseUrl = this.configService.get<string>('TRACCAR_API_URL') || 'http://localhost:8082';
@@ -86,6 +86,11 @@ export class TraccarClientService implements OnModuleInit {
    * Authenticate with Traccar and get session cookie
    */
   async authenticate(): Promise<boolean> {
+    if (!this.adminUser || !this.adminPassword) {
+      this.logger.warn('Traccar credentials not configured - skipping authentication');
+      return false;
+    }
+
     try {
       const response = await this.client.post(
         '/api/session',