Rework the first-run setup wizard around what a site cannot run without

The wizard configured five of the product's 129 settings. A site that finished
it still had no timezone, no authentication, no mail server, no backup
destination and no endpoint agent policy, and nothing told the operator so.

Six steps now: Administrator, Site, Authentication, Features, Mail and Backups,
Review. Everything else moves to a standing setup checklist at
/settings/setupchecklist, because a wizard that asked for all 129 settings would
be worse than one that asked for none.

Two new endpoints back it. /setup/checklist reports twelve areas as
ok/partial/todo/na with a link to the page that fixes each, and /setup/health
reports account counts plus whether a plugin toggle has reached every worker.
Both take care not to lie:

- Several settings are SEEDED non-empty (the shipped logo, a placeholder floor
  plan, every identifier field), so "is it set" compares against the shipped
  default rather than emptiness.
- plugin.endpoints.sharedkeyallowed DEFAULTS TO ALLOWED when its row is absent,
  so an absent row is reported as the fleet-wide key being accepted. Reporting
  it as refused told an admin the opposite of the truth about the credential
  they are migrating away from.
- A plugin is held at "starting" until several DISTINCT workers report it live.
  Counting replies instead let one recycled worker answer four times and declare
  a change complete while other workers still served the old routes.

Recommended plugins are declared in each plugin's manifest rather than listed in
the wizard, so adding a plugin cannot leave a stale list in another file.

Also fixed: the logo preview was invisible, because the image borrowed a class
that hardcodes a white background while the shipped logo is white; and signing
in did not re-read setup state, so an admin already browsing was never steered
to the wizard and a hard refresh was the only cure.

(cherry picked from commit 32d3f4b29d)

frontend/src/api/index.js

@@ -1246,6 +1246,16 @@ export const setupApi = {
   seedStarter() {
     return api.post('/setup/seed-starter')
   },
+  // What is configured and what is not, with a route to each fix. Backs the
+  // standing Setup Checklist page as well as the wizard's review step.
+  checklist() {
+    return api.get('/setup/checklist')
+  },
+  // Account counts plus whether plugins.json and the running process disagree,
+  // which is the only way to tell that a plugin toggle needs a restart.
+  health() {
+    return api.get('/setup/health')
+  },
   complete() {
     return api.post('/setup/complete')
   }