v0.2.0

First-login setup wizard

A fresh deployment now opens a guided setup wizard on first login, covering everything after the Cloudflare-side runbook steps:

1. Environment check: confirms your operator identity and ENVIRONMENT, and warns if the development bypass is active on a non-localhost origin. Reaching the page at all proves Access and in-Worker JWT validation are working.
2. Instance settings: just the values artifact generation needs (public base URL prefilled from the page origin, version suffix label, optional CIPP server URL).
3. First upstream sync with the snapshot version and fetch time on success.
4. Tenant zero: creates your first tenant and publishes its default ruleset in one click.
5. Deploy and verify: points at the Artifacts tab and explains end-to-end verification via the fetch counter.

Every step's badge derives from live server state, so the wizard is resumable, idempotent, and safe with multiple operators. The top nav stays fully usable throughout, Skip for now dismisses it permanently, and instances upgrading from v0.1.0 never see it.

Also in this release

• GET /api/instance/status: aggregate first-run status endpoint backing the wizard
• CodeQL scanning on push, pull request, and a weekly schedule
• Issue templates that enforce the no-real-client-data rule up front
• Dashboard screenshots in the README, including the wizard

Full changelog: v0.1.0...v0.2.0