Redesign the frontend UI on twui

Rebuild every page on a shared set of twui-based primitives with a dense
ops-console look, WireGuard red accent and light/dark/system theming.

- Add design tokens (WireGuard red accent, zinc neutrals, theme-flipping
  semantic colours) and a no-flash theme cookie + toggle
- Add shared components: page header, panel, sub-nav, data table with
  mobile card list, stat tile, status dot, key-value list, copy button,
  inline alert, empty state, form section/actions, confirm dialog and
  toast providers
- New admin shell (sidebar, sticky header, mobile drawer) and a centered
  shell for auth and 404; strip the public template pages
- Unify adding clients at /admin/clients/add with a host picker; tabbed
  client detail (Overview / Rules / Config & QR) with config copy/download
- Re-run client setup after rule changes on the detail page so the
  firewall matches the DB
- Split Setup into status/maintenance/firewall and Settings into
  profile/password subpages
- Replace window.confirm/alert and page reloads with in-app dialogs,
  toasts and in-place list updates
- Fix nested rule form submitting the client form, prefilled signup
  passwords, hidden submit buttons, fields not updating after "next
  free" lookups, and TinyMCE white-on-white in dark mode

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/setup/(functions)/build-setup-runtime-checks.ts

@@ -0,0 +1,32 @@
+import type { SetupCheckItem } from "../(partials)/setup-check-status-item";
+import type { SystemSetupStatus } from "../(hooks)/use-system-setup-status";
+
+type Params = {
+    setup_status: SystemSetupStatus;
+};
+
+export default function buildSetupRuntimeChecks({ setup_status }: Params): SetupCheckItem[] {
+    return [
+        {
+            key: "kernel-module",
+            title: "WireGuard kernel module",
+            subtitle: "/sys/module/wireguard",
+            ok: setup_status.wg_module_loaded,
+            ok_label: "Loaded",
+        },
+        {
+            key: "wg-quick-helper",
+            title: "wg-quick manage helper",
+            subtitle: `/var/lib/wgui/scripts/wg-quick-manage.sh`,
+            ok: setup_status.wg_quick_helper_installed,
+            ok_label: "Installed",
+        },
+        ...setup_status.lib_dirs.map((dir) => ({
+            key: dir.path,
+            title: `Runtime directory · ${dir.label}`,
+            subtitle: dir.path,
+            ok: dir.exists,
+            ok_label: "Exists",
+        })),
+    ];
+}