Onboard on first open and keep link state fresh

[ilovecrayons]

Implements plan Step 5 (onboarding first-open and link state) from the Aether refresh.

Changes

• UiSlice gains persisted onboarded, onboardingStep, onboardingWorkspace; completing the wizard or navigating away from it sets onboarded and clears the wizard state (navigating to onboarding while already there preserves state).
• hydrate routes to onboarding iff !onboarded && hasLocal('link.status'); remote monitors are never redirected.
• Wizard resumes the persisted step and workspace after a reload; RepoStep renders the repo form without a selected workspace (server resolves the sole workspace); FirstRunStep shows a Back-to-Workspace fallback when the workspace is missing.
• LinkStep renders three states (no server / server configured but no repo / both) and re-checks link.status on window focus in addition to Retry.
• internal/localgw: link.status gains server_configured (cfg.Addr != ""); snapshot() re-reads the config when its mtime changes so a CLI aether link while the GUI is open shows up without a restart. Linking through the GUI refreshes the cached config and mtime together; if the active named profile disappears from the file, the cached config is retained and re-checked later.
• Settings LinkCard reads the same three-state shape.
• Docs: docs/local-gateway.md link.status row, docs/dashboard-frontend.md onboarding section.

Verification (plan item 6)

Vitest proves hydrate routes to onboarding iff !onboarded && hasLocal('link.status') (RED first: expected onboarding, got board).

web$ bun install --frozen-lockfile && bun run typecheck && bun run test
Test Files  47 passed (47)
Tests  527 passed (527)

$ make fmt-check && make vet && make lint && make test && make public-audit
golangci-lint: 0 issues.
go test -race ./...: all packages passed
public audit: PASS

Note: the full Go suite was run with isolated HOME/XDG_DATA_HOME; on a host with ~/.local/share/aether/desktop installed, two pre-existing update_apply tests on main assert environment-dependent behavior unrelated to this PR.

Adversarially reviewed; fixes for all findings are included (navigate-to-self state wipe, named-profile repo clobber after GUI link, RepoStep dead end, Windows test config-dir leak, missing-profile fallback).