Setup wizard: Test connection + Save & configure

Two-step device setup so the admin verifies before committing — and never touches
the device's own web UI.

- POST /api/setup/test (admin-only): healthCheck + checkPreconditions, no save and
  no device change. Returns device health + precondition issues.
- assign (Save) now also runs fixPreconditions (e.g. disables input_link_relay so
  a button press doesn't auto-fire its relay) before configuring the input push.
  Closes a gap where an assigned device could still auto-open. Fails the save with
  no DB row if device configuration fails (no orphan/half-configured rows).
- SetupWizard: wires config fields -> Test connection (health badge + precondition
  warnings) -> Save & configure; editing config resets prior test/save status.

Verified in-browser against the real device: Test -> ● ready + preconditions OK;
Save -> row persisted AND the device's Input Link URL written (push path matches
the saved device id). wiki/first-run-setup updated.

wiki/concepts/first-run-setup.md

@@ -18,11 +18,16 @@ each device's connection config.
 1. **Read the catalog** — `GET /api/setup/catalog` returns supported drivers per category (no
    secrets, just schema) plus a `discoverable` list. The web `SetupWizard` renders a picker + the
    driver's config fields, and a **Scan** button for discoverable drivers ([[device-discovery]]).
-2. **Assign per lane** — `POST /api/setup/assign` (admin-only, role-guarded; see
-   [[local-jwt-auth]]). The server validates the chosen driver + config against the registry
-   before persisting to the `lane_devices` table; unknown drivers / missing required fields are
-   rejected.
-3. **Complete** — `POST /api/setup/complete` marks the single-row `setup_state`.
+2. **Test** (optional, no save) — `POST /api/setup/test` (admin-only). Validates the config,
+   probes reachability (`healthCheck`), and reports preconditions (e.g. `input_link_relay`) —
+   **without** saving or changing the device. The wizard's **Test connection** button shows a
+   health badge + any precondition warnings.
+3. **Save & configure** — `POST /api/setup/assign` (admin-only). Validates, then **configures the
+   device**: fixes preconditions (e.g. disables `input_link_relay`) and sets up the Digest-
+   authenticated input push ([[device-input-flow]]) — the admin never touches the device's own web
+   UI. **Fails the save** (no DB row) if the device can't be configured, so there are no
+   orphan/half-configured rows. On success persists to `lane_devices`.
+4. **Complete** — `POST /api/setup/complete` marks the single-row `setup_state`.
 
 ## Config granularity