feat(deploy): one-time setup page joins the tailnet in the browser (SPEC-605)

[iret77]

Closes #550 once the live onboarding run is green.

Live onboarding test 2026-10-08: on an existing server with password login and a chat-only assistant, the only route left was the provider's web console plus hand-editing a Tailscale key into a long line. Owner decision: Home-Assistant-style setup page — no key, no terminal for the key, nothing secret through the chat.

What

• v3/deploy/setup-page.py (SPEC-605): host-side, stdlib-only. Runs tailscale up without a key, serves http://<server>:8420/ — code form → "Connect with Tailscale" (the login link Tailscale printed) → "Done, palaia at http://:8420/". Wrong code: nothing, 1 s delay. Exits 0 when joined, 1 on 30-min timeout; port closed, tailscale up child terminated. Makes up and prints a code if PALAIA_SETUP_CODE is empty.
• get-palaia.sh: no key and not on a tailnet → setup page (embedded verbatim; temporary ufw rule when ufw is active; stdin detached because the script itself arrives on stdin). PALAIA_TSKEY unchanged.
• cloud-init.yaml: PALAIA_SETUP_CODE is the one thing to fill in; a filled TAILSCALE_AUTH_KEY still wins; guard matches the marker word, so the old "replace every placeholder" trap is gone. 20 KB (< Hetzner's 32 KiB; AWS's 16 KB is noted in the README).
• Install skill: Steps 2–6 rewritten around the page; the assistant makes up the code; 3c first offers recreating an empty server with the setup file (no console at all); key path kept for technical users, with "palaia" as key description.
• Host-side, not in the hub → no image change, no release; get.palaia.ai serves main.

Verified

• pytest tests/deploy tests/clients tests/test_version_drift.py tests/docs_site green; docs vitest 20 passed; ruff clean.
• test_setup_page.py runs the real script against a fake tailscale: no link without the code (page and status), link with it, done + exit 0 after "login", timeout exit 1 + port closed, already-joined skip, generated code format. Embeds byte-identical; guard picks page vs key (bash-executed); dash -n on the installer; heredoc round-trips through | dash.

Not verified (first live run is the onboarding test on the owner's VPS)

• The installer's no-key branch end-to-end as root (ufw, sudo env …, real tailscale up login link format).
• cloud-init + embedded page on a real first boot.
• The askpass password login from fix(install-skill): one-step SSH access, password path via Run line #546.

Open

• Onboarding page i18n (v3/site/docs/src/i18n/onboarding/*.json) still describes the key flow — see question in Setup page: join the tailnet in the browser — no key, no terminal, nothing through the chat #550.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[iret77]

Second review (Codex gpt-6-astra, read-only, security focus): 5 findings, all verified against the code and fixed in d9408fc — unbounded connection threads (now 32 max, 10 s timeout), SIGTERM/SIGHUP skipping clean-up, emptied cloud-init key bypassing the code page, installer deleting a pre-existing ufw rule, setup code visible in sudo arguments. Own addition: the pending Tailscale login is dropped (tailscale logout) whenever the page ends without a join. New tests cover each. No code-bypass or login-link leak found.