Overhaul setup wizard: domain config, password strength, field alignment

Password:
- Add lowercase to strength scoring; "Good" now requires all API criteria
  (12 chars, upper, lower, digit) — no more submitting passwords the API rejects
- isReady gates the Next button on meeting API requirements, not just length

Domain steps 3 + 4:
- Step 3: choose pic_ngo / custom / lan (sends valid API domain_modes)
- Step 4 (pic.ngo): shows derived [cellName].pic.ngo domain preview
- Step 4 (custom): domain name field + TLS method selector
  (Cloudflare DNS-01 + API token, DuckDNS + token, HTTP-01 + port-80 warning)
- Step 4 skipped entirely for LAN-only
- Review step shows actual domain string and TLS method instead of opaque codes

Cell name:
- Description and preview hint make clear it becomes the pic.ngo subdomain
- Step 1 shows live "name.pic.ngo" preview as you type

Backend:
- setup_manager now accepts and stores domain_name, cloudflare_api_token,
  duckdns_token for Phase 3 DDNS registration use

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/setup_manager.py

@@ -128,9 +128,12 @@ class SetupManager:
         cell_name = payload.get('cell_name', '')
         password = payload.get('password', '')
         domain_mode = payload.get('domain_mode', '')
+        domain_name = payload.get('domain_name', '')
         timezone = payload.get('timezone', '')
         services_enabled = payload.get('services_enabled', [])
         ddns_provider = payload.get('ddns_provider', 'none')
+        cloudflare_api_token = payload.get('cloudflare_api_token', '')
+        duckdns_token = payload.get('duckdns_token', '')
 
         errors.extend(self.validate_cell_name(cell_name))
         errors.extend(self.validate_password(password))
@@ -185,16 +188,19 @@ class SetupManager:
             # ── persist identity fields ────────────────────────────────────
             self.config_manager.set_identity_field('cell_name', cell_name)
             self.config_manager.set_identity_field('domain_mode', domain_mode)
+            if domain_name:
+                self.config_manager.set_identity_field('domain_name', domain_name)
             self.config_manager.set_identity_field('timezone', timezone)
             self.config_manager.set_identity_field('services_enabled', services_enabled)
             self.config_manager.set_identity_field('ddns_provider', ddns_provider)
+            if cloudflare_api_token:
+                self.config_manager.set_identity_field('cloudflare_api_token', cloudflare_api_token)
+            if duckdns_token:
+                self.config_manager.set_identity_field('duckdns_token', duckdns_token)
 
-            # NOTE: DDNS registration is deferred to Phase 3.
-            # For now we just store ddns_provider in config.
             logger.info(
-                'DDNS registration skipped (Phase 1). '
-                'DDNS registration will happen in Phase 3. '
-                f'ddns_provider={ddns_provider!r} stored in identity config.'
+                'DDNS registration deferred to Phase 3. '
+                f'ddns_provider={ddns_provider!r} domain_name={domain_name!r}'
             )
 
             # ── mark setup complete (must be last) ─────────────────────────