Live onboarding wizard: real discovery, repo pick, and bootstrap

The 4-step wizard is now fully live — nothing faked.

Backend (core + main):
- GiteaClient.createLabel (POST /labels).
- core/gitea/bootstrap.ts: SCHEMA_LABELS (the full est/p/deadline vocabulary with
  colors+descriptions), applySchemaLabels (idempotent — creates only missing),
  repoExists + ensurePmStateRepo (token-scoped, org vs personal endpoint). 7 tests.
- config:bootstrap IPC handler + preload bridge + BootstrapResult type.

Wizard:
- Connect step → live config.discover ('connected · N repos visible' is real).
- Repo step → owner dropdown + repo radios from the discovered repos.
- Bootstrap step → real: applies the label schema + ensures the pm-state sidecar,
  shows the actual outcome (created vs already-present), then saves config.
- Gate: first run (no config) → wizard; reconnect (existing) → the compact card.
  Removed the dead 'firstrun' dev view.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/src/main/gitea.ts

@@ -12,8 +12,10 @@ import { dirname, join } from 'node:path'
 
 import {
   appendDirective,
+  applySchemaLabels,
   createGiteaClient,
   discoverRepos,
+  ensurePmStateRepo,
   GiteaApiError,
   type DirectiveEntry,
   type GiteaClient,
@@ -371,6 +373,27 @@ export function registerGiteaIpc(): void {
     }
   })
 
+  // First-run bootstrap: apply the label schema to the work repo and ensure the
+  // pm-state sidecar exists. Idempotent — safe to re-run. `underOrg` tells us
+  // whether `owner` is an org (vs the token's personal namespace).
+  ipcMain.handle(
+    'config:bootstrap',
+    async (_event, req: { baseUrl: string; token: string; owner: string; repo: string; underOrg: boolean }) => {
+      try {
+        const conn = { baseUrl: req.baseUrl.replace(/\/+$/, ''), token: req.token }
+        const owner = req.owner.trim()
+        const repo = req.repo.trim()
+        const client = createGiteaClient({ ...conn, owner, repo }, fetch)
+        const labels = await applySchemaLabels(client)
+        const pmStateRepo = `${repo}-pm-state`
+        const pmState = await ensurePmStateRepo(conn, { owner, repo: pmStateRepo, underOrg: req.underOrg }, fetch)
+        return { ok: true as const, labels, pmState, pmStateRepo }
+      } catch (e) {
+        return { ok: false as const, error: e instanceof GiteaApiError ? `${e.status}` : e instanceof Error ? e.message : String(e) }
+      }
+    },
+  )
+
   // Validate a token + repo before saving: any authed read on the repo proves access.
   ipcMain.handle('config:test', async (_event, cfg: AppConfig) => {
     try {