Restore setup splash and reuse authorization across repair steps

[Staphylococcus]

Summary

Restore the setup-required splash and modal repair flow, and reuse native authorization across setup steps in both GUI and CLI.

• Keep the normal application header and a single Complete setup CTA; cached assessment reads do not open a setup flow.
• Open the existing shared setup flow in a modal with its own header. Cancelling returns to the gated splash; normal pages remain unavailable until daemon verification.
• Give each explicit flow one persistent, unprivileged authorization owner: Polkit for GUI and sudo for CLI, including parent-scoped sudo cache reuse.
• Retain native expiry, terminal prompts, noninteractive sudo -n, separately approved build dependencies, and exclusion until outstanding helpers finish.
• Update documentation, GTK scenarios, and installed GUI accessibility/journey expectations for the restored splash/modal interaction.

Scope

• This PR addresses one concern only: the setup/repair workflow and its authorization lifetime.
• I split unrelated fixes, refactors, cleanup, or formatting into separate PRs.
• I read CONTRIBUTING.md and the relevant docs linked there.
• I discussed design-sensitive changes first.

User-Visible Behavior

Incomplete setup presents one splash CTA that opens the setup modal. Cancelling does not unlock the application. Administrator permission can be reused across service repair and Plasma setup while native policy permits it, without storing passwords or keeping a privileged shell alive. Dependency installation still requires separate consent.

Validation

• cargo test --locked -p lg-buddy: passed, including 1,414 backend unit tests (1 ignored), all integration tests, 155 Cucumber scenarios / 1,988 steps, and documentation tests.
• GTK frontend tests on an isolated Xvfb display and private session bus: 2 passed.
• Strict Clippy across both crates, all targets and features; ShellCheck for the authorization worker; git diff --check.
• Authorization tests as a regular user and isolated user-namespace root, covering shared process identity, expiry, denial, helper failure, consent, and frontend death/lock retention.
• Pseudo-terminal test verifies authorization input stays separate from the worker protocol.

Real host sudo/Polkit dialogs and privileged installation were not exercised. Installed release-bundle and distro lanes remain for CI.

Related Issue

Relates to #275.