Show a first-run setup card on cold installs - #119

Implements section 1 of the approved onboarding mockup
(docs/design/onboarding-setup-card.html): a brand-new install's empty
draft thread now opens on a boxless, hairline-divided setup card instead
of the bare "What's next" prompt. One live row per provider (settings
status language, dot flips green while the sign-in terminal is open, Sign
in runs the same auth flow the composer notice uses, Install guide routes
to provider settings), a project row for the bootstrapped launch folder,
and Start first thread that enables once one provider is usable and a
project exists.

Shows only on a genuine cold start: local draft thread, not General Chat,
not the hosted surface, environment bootstrapped, no user message ever
sent in the environment. Skip for now, Start first thread, and any send
dismiss it permanently per environment (schema-validated localStorage,
versionSkew dismissal pattern). While the card is visible the ambient
provider-status notice is suppressed; the card already states the same
problem with the same fix actions.

Screenshot verification caught the real bug: a reloaded draft thread has
no project bound yet, so the card claimed "No folder yet" while the
sidebar showed the bootstrapped workspace project. The card now falls
back to the workspace project list (and the stale memo deps that would
have hidden the fix are corrected).

Also from maintainer review of the gallery:
- The card inherits the empty state's identity: the Threadlines figure
  above the heading and the same staged rise animation
- The project row shows the project's favicon like every other project
  selector

Provider status details are written for the settings page and can run to
a paragraph with install URLs; the Claude row rendered four lines. The
card keeps the headline plus the first sentence; the full recipe stays
one click away behind the row's action.

Maintainer feedback on the verified screenshots: the full-size figure
pushed the card down until the footer crowded the composer, and a
row-per-provider list cannot grow with future providers.

- The card uses a two-thirds figure with tighter margins, slimmer row
  padding, and guaranteed clearance above the composer
- Provider rows order by actionability (sign-in, install, ready) instead
  of settings order; a checklist leads with the shortest path to one
  working agent, which also puts bundled Codex first on cold installs
- The card caps at three provider rows; the rest collapse into a single
  More agents row pointing at Settings, so four or more providers never
  stretch the checklist