Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs

frontend/src/views/SetupWizard.vue

@@ -117,8 +117,9 @@
 
         <!-- Starter data -->
         <div v-else-if="current.key === 'data'">
-          <h2>Starter data</h2>
-          <p class="hint">Seed the data a new site needs. Both are idempotent - safe to run more than once.</p>
+          <h2>Reference data</h2>
+          <p class="hint">Seed the lookup data a new site needs: statuses, types, permissions, and a short list of common vendors. Both are idempotent - safe to run more than once.</p>
+          <p class="hint">This does not create any assets. The site starts empty and assets are loaded afterwards via the import API, so an empty dashboard here is expected.</p>
           <div class="starter-actions">
             <div>
               <button class="btn btn-secondary" :disabled="seeding" @click="seedReference">
@@ -181,7 +182,7 @@ const steps = [
   { key: 'site', label: 'Site' },
   { key: 'plugins', label: 'Features' },
   { key: 'map', label: 'Floor Map' },
-  { key: 'data', label: 'Starter Data' },
+  { key: 'data', label: 'Reference Data' },
   { key: 'finish', label: 'Finish' },
 ]
 const step = ref(0)