Setup and invitations: the first login made from the client, everyone else by a group's invitation

PrivaPub's sign-up is closed. While it has no administrator, Login offers /setup, where the first login is made with its
first persona and becomes the administrator (PrivaPub's /clientapi/user/setup; owner decision 2026-10-16: first come,
first served, and setup then closes for good). Everyone else joins at /join?code=: a group's invitation makes the login,
and its first persona joins the group (/clientapi/user/invitation/signup). Login links there, and a group's page shows
the link next to its code. A login without a persona is sent from Login to Settings instead of a dead end. Login, setup
and join share AuthService's StartSession, and all three go without credentials.

e2e (Login/SignUpTests, against the pasture): setup offered on Login, made, the feed reached with Administration, then a
signed-out reader is offered sign-in and invitations only; an invitation link makes a login whose persona joins the
circle. The phone sweep covers /setup and /join: login, setup and join fit every portrait phone, and AccountTests signs
in through the changed Login. The town's signed-in tests were not rerun: today's pasture came up without Mastodon, and
its town seed left stale sessions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Models/APIs.cs

@@ -14,6 +14,9 @@ public static class APIs
 	public static class ClientApi
 	{
 		public const string POST_Login = "clientapi/user/login";
+		public const string GET_Setup = "clientapi/user/setup";
+		public const string POST_Setup = "clientapi/user/setup";
+		public const string POST_InvitationSignUp = "clientapi/user/invitation/signup";
 		public const string GET_Logout = "clientapi/user/logout";
 		public const string GET_SniffAgain = "clientapi/user/sniff/again";
 		public const string POST_UpdatePassword = "clientapi/user/update/password";