onboarding: move first-run login into the TUI guided flow

The fresh-install path used to block at the CLI with an Approve sources
import prompt and a 39-item provider selection menu before the TUI even
launched. Onboarding now happens entirely inside the TUI:

- CLI: maybe_prompt_server_bootstrap_login no longer runs the blocking
  import/provider prompts for the interactive TUI launch. The server
  spawns unauthenticated and the TUI drives login. A JCODE_CLI_BOOTSTRAP_LOGIN
  env var preserves the old blocking behavior for headless provisioning.
- TUI: add an OnboardingPhase::Login at the front of the guided flow.
  When we boot without working credentials we start there, render a
  'log in to get started' welcome card, and Enter opens the existing
  login picker (which already offers external-auth import). On a
  successful login we advance Login -> ModelSelect.

Tests cover begin_at_login, Login->ModelSelect advance, Enter opening
the picker, and the startup check landing in Login when unauthenticated.