feat(setup): first-run gate, hub-first preview, honest wording — setup before the app

Stefan's live findings, all four addressed at the root:

- 'In 3 Fragen loslegen' read like ad copy → the entry is now plainly
  'Einrichtung starten' / 'Start setup'.
- The setup button sat permanently on the Welcome page of a running
  app ('setup after the app runs is backwards' — reported twice). A
  fresh install now starts INSIDE the setup: SetupGateScreen hosts
  the wizard embedded as the page (new embedded/onFinished modes on
  GuidedSetupDialog), with an explicit 'Später einrichten' skip.
  Welcome loses the setup button entirely and stays a calm intro.
- Re-running the setup later lives in Settings → General ('Run setup
  again…'), the single post-first-run home.
- 'You must grant access first and only then see what will be done':
  the preview used to spawn the chain CLI, whose first run could pop
  the macOS permission prompt BEFORE the plan was ever shown. The
  preview now calls the new PlanSetup RPC over the live hub
  connection (no subprocess, nothing granted); the CLI remains only
  a fallback when no hub is reachable — and applying stays the
  explicit, separate step.

Widget tests: gate hosts the wizard + skip/cancel leave it; CLI-path
tests drive the fallback through the new hub-preview test seam.
Suite 76 green, analyze clean.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_de.arb

@@ -1791,7 +1791,11 @@
   "setupSigPublicStoreNotice": "Diese Einrichtung lässt nur signierte Module zu. Der öffentliche Store liefert zurzeit unsignierte Pakete — die vorbereiteten Module kommen daher aus einer eigenen, signierten Quelle.",
   "setupAllowUnsigned": "Installation aus dem öffentlichen Store erlauben",
   "setupAllowUnsignedSub": "Lockert die Signaturpflicht bewusst. Gut zum Ausprobieren — für den regulierten Betrieb später wieder aktivieren.",
-  "setupStartCta": "In 3 Fragen loslegen",
+  "setupStartCta": "Einrichtung starten",
+  "setupGateIntro": "Bevor es losgeht: drei Fragen, dann richtet Ch∆In diesen Rechner passend ein. Nichts wird ohne Ihre Bestätigung geändert.",
+  "setupGateSkip": "Später einrichten",
+  "settingsRunSetup": "Einrichtung erneut ausführen…",
+  "settingsRunSetupHint": "Öffnet den Einrichtungs-Assistenten (drei Fragen, Vorschau, Übernehmen). Die bestehende Konfiguration wird erst nach Ihrer Bestätigung ersetzt.",
   "setupPlanRunbookLocal": "Eingerichtet wird dieser Rechner; der Hub läuft lokal und wird bei Bedarf gestartet.",
   "setupPlanRunbookService": "Eingerichtet wird dieser Rechner: Der Hub startet künftig automatisch beim Hochfahren (Hintergrund-Dienst). Für einen anderen Server führen Sie die Einrichtung dort aus.",
   "setupPlanRunbookAirgap": "Vorgesehen für einen isolierten Server ohne Internet — Module und Updates kommen als Offline-Paket.",

lib/l10n/app_en.arb

@@ -1830,7 +1830,11 @@
   "setupSigPublicStoreNotice": "This setup only accepts signed modules. The public store currently ships unsigned bundles — the prepared modules therefore come from your own, signed source.",
   "setupAllowUnsigned": "Allow installing from the public store",
   "setupAllowUnsignedSub": "Deliberately relaxes the signature requirement. Fine for trying things out — re-enable it for regulated operation.",
-  "setupStartCta": "Get started in 3 questions",
+  "setupStartCta": "Start setup",
+  "setupGateIntro": "Before you start: three questions, then Ch∆In sets this machine up to match. Nothing changes without your confirmation.",
+  "setupGateSkip": "Set up later",
+  "settingsRunSetup": "Run setup again…",
+  "settingsRunSetupHint": "Opens the setup assistant (three questions, preview, apply). Your existing configuration is only replaced after you confirm.",
   "setupPlanRunbookLocal": "This machine is being set up; the hub runs locally and starts on demand.",
   "setupPlanRunbookService": "This machine is being set up: the hub will start automatically on boot (background service). For a different server, run the setup there.",
   "setupPlanRunbookAirgap": "Intended for an isolated server without internet — modules and updates arrive as offline bundles.",

lib/l10n/app_localizations.dart

@@ -5524,9 +5524,33 @@ abstract class AppLocalizations {
   /// No description provided for @setupStartCta.
   ///
   /// In en, this message translates to:
-  /// **'Get started in 3 questions'**
+  /// **'Start setup'**
   String get setupStartCta;
 
+  /// No description provided for @setupGateIntro.
+  ///
+  /// In en, this message translates to:
+  /// **'Before you start: three questions, then Ch∆In sets this machine up to match. Nothing changes without your confirmation.'**
+  String get setupGateIntro;
+
+  /// No description provided for @setupGateSkip.
+  ///
+  /// In en, this message translates to:
+  /// **'Set up later'**
+  String get setupGateSkip;
+
+  /// No description provided for @settingsRunSetup.
+  ///
+  /// In en, this message translates to:
+  /// **'Run setup again…'**
+  String get settingsRunSetup;
+
+  /// No description provided for @settingsRunSetupHint.
+  ///
+  /// In en, this message translates to:
+  /// **'Opens the setup assistant (three questions, preview, apply). Your existing configuration is only replaced after you confirm.'**
+  String get settingsRunSetupHint;
+
   /// No description provided for @setupPlanRunbookLocal.
   ///
   /// In en, this message translates to:

lib/l10n/app_localizations_de.dart

@@ -3270,7 +3270,21 @@ class AppLocalizationsDe extends AppLocalizations {
       'Lockert die Signaturpflicht bewusst. Gut zum Ausprobieren — für den regulierten Betrieb später wieder aktivieren.';
 
   @override
-  String get setupStartCta => 'In 3 Fragen loslegen';
+  String get setupStartCta => 'Einrichtung starten';
+
+  @override
+  String get setupGateIntro =>
+      'Bevor es losgeht: drei Fragen, dann richtet Ch∆In diesen Rechner passend ein. Nichts wird ohne Ihre Bestätigung geändert.';
+
+  @override
+  String get setupGateSkip => 'Später einrichten';
+
+  @override
+  String get settingsRunSetup => 'Einrichtung erneut ausführen…';
+
+  @override
+  String get settingsRunSetupHint =>
+      'Öffnet den Einrichtungs-Assistenten (drei Fragen, Vorschau, Übernehmen). Die bestehende Konfiguration wird erst nach Ihrer Bestätigung ersetzt.';
 
   @override
   String get setupPlanRunbookLocal =>

lib/l10n/app_localizations_en.dart

@@ -3265,7 +3265,21 @@ class AppLocalizationsEn extends AppLocalizations {
       'Deliberately relaxes the signature requirement. Fine for trying things out — re-enable it for regulated operation.';
 
   @override
-  String get setupStartCta => 'Get started in 3 questions';
+  String get setupStartCta => 'Start setup';
+
+  @override
+  String get setupGateIntro =>
+      'Before you start: three questions, then Ch∆In sets this machine up to match. Nothing changes without your confirmation.';
+
+  @override
+  String get setupGateSkip => 'Set up later';
+
+  @override
+  String get settingsRunSetup => 'Run setup again…';
+
+  @override
+  String get settingsRunSetupHint =>
+      'Opens the setup assistant (three questions, preview, apply). Your existing configuration is only replaced after you confirm.';
 
   @override
   String get setupPlanRunbookLocal =>