Redesign the frontend UI on twui

Rebuild every page on a shared set of twui-based primitives with a dense
ops-console look, WireGuard red accent and light/dark/system theming.

- Add design tokens (WireGuard red accent, zinc neutrals, theme-flipping
  semantic colours) and a no-flash theme cookie + toggle
- Add shared components: page header, panel, sub-nav, data table with
  mobile card list, stat tile, status dot, key-value list, copy button,
  inline alert, empty state, form section/actions, confirm dialog and
  toast providers
- New admin shell (sidebar, sticky header, mobile drawer) and a centered
  shell for auth and 404; strip the public template pages
- Unify adding clients at /admin/clients/add with a host picker; tabbed
  client detail (Overview / Rules / Config & QR) with config copy/download
- Re-run client setup after rule changes on the detail page so the
  firewall matches the DB
- Split Setup into status/maintenance/firewall and Settings into
  profile/password subpages
- Replace window.confirm/alert and page reloads with in-app dialogs,
  toasts and in-place list updates
- Fix nested rule form submitting the client form, prefilled signup
  passwords, hidden submit buttons, fields not updating after "next
  free" lookups, and TinyMCE white-on-white in dark mode

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/setup/(sections)/setup-page-frame.tsx

@@ -0,0 +1,36 @@
+import type { PropsWithChildren } from "react";
+import PageHeader from "@/src/components/general/page-header";
+import PageBody from "@/src/components/general/page-body";
+import SubNav from "@/src/components/general/sub-nav";
+import InlineAlert from "@/src/components/general/inline-alert";
+import { SetupNav } from "../(data)/setup-nav-dict";
+
+type Props = PropsWithChildren & {
+    title: string;
+    description: string;
+    /** `false` shows the not-root warning */
+    is_root?: boolean;
+};
+
+/** Header, sub-navigation and body shared by the three setup subpages. */
+export default function SetupPageFrame({ title, description, is_root, children }: Props) {
+    return (
+        <>
+            <PageHeader
+                title={title}
+                description={description}
+                back={{ href: "/admin", title: "Dashboard" }}
+                nav={<SubNav label="Setup sections" items={SetupNav} />}
+            />
+            <PageBody>
+                {is_root === false ? (
+                    <InlineAlert
+                        tone="warning"
+                        msg="wg-ui isn't running as root. Installs and tunnel management may fail."
+                    />
+                ) : null}
+                {children}
+            </PageBody>
+        </>
+    );
+}