Setup wizard: Test connection + Save & configure

Two-step device setup so the admin verifies before committing — and never touches
the device's own web UI.

- POST /api/setup/test (admin-only): healthCheck + checkPreconditions, no save and
  no device change. Returns device health + precondition issues.
- assign (Save) now also runs fixPreconditions (e.g. disables input_link_relay so
  a button press doesn't auto-fire its relay) before configuring the input push.
  Closes a gap where an assigned device could still auto-open. Fails the save with
  no DB row if device configuration fails (no orphan/half-configured rows).
- SetupWizard: wires config fields -> Test connection (health badge + precondition
  warnings) -> Save & configure; editing config resets prior test/save status.

Verified in-browser against the real device: Test -> ● ready + preconditions OK;
Save -> row persisted AND the device's Input Link URL written (push path matches
the saved device id). wiki/first-run-setup updated.

wiki/log.md

@@ -162,3 +162,15 @@ as "writes don't apply" all session; (2) the `pass` field caps at 31 chars →
 use a 24-char password. Driver #writeConfig now polls-until-verified (device
 reboots on apply). VERIFIED on hardware: assign auto-configures the device, then
 all 4 inputs push with Digest auth, zero failures. Recorded in [[device-input-flow]].
+
+## [2026-06-15] feature | Setup wizard: Test connection + Save & configure
+Two-step device setup UX. New admin-only POST /api/setup/test (healthCheck +
+checkPreconditions, no save / no device change). The assign (Save) step now also
+fixes preconditions (disables input_link_relay) before configuring push — closing
+a gap where assigned devices could still auto-fire relays; fails the save with no
+DB row if device config fails (no orphan rows). SetupWizard wires the config
+fields → Test button (health badge + precondition warnings) → Save & configure
+button. Verified in-browser against the real device: Test shows ● ready +
+preconditions OK; Save persists the row AND writes the device's Input Link URL
+(push path matches the saved device id). Admin never logs into the device web UI.
+Updated [[first-run-setup]].