Live onboarding wizard: real discovery, repo pick, and bootstrap

The 4-step wizard is now fully live — nothing faked.

Backend (core + main):
- GiteaClient.createLabel (POST /labels).
- core/gitea/bootstrap.ts: SCHEMA_LABELS (the full est/p/deadline vocabulary with
  colors+descriptions), applySchemaLabels (idempotent — creates only missing),
  repoExists + ensurePmStateRepo (token-scoped, org vs personal endpoint). 7 tests.
- config:bootstrap IPC handler + preload bridge + BootstrapResult type.

Wizard:
- Connect step → live config.discover ('connected · N repos visible' is real).
- Repo step → owner dropdown + repo radios from the discovered repos.
- Bootstrap step → real: applies the label schema + ensures the pm-state sidecar,
  shows the actual outcome (created vs already-present), then saves config.
- Gate: first run (no config) → wizard; reconnect (existing) → the compact card.
  Removed the dead 'firstrun' dev view.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/src/preload/index.ts

@@ -29,6 +29,8 @@ const api = {
     get: () => ipcRenderer.invoke('config:get'),
     /** Discover the owners + repos a token can reach (for the onboarding pickers). */
     discover: (conn: unknown) => ipcRenderer.invoke('config:discover', conn),
+    /** Apply the label schema + ensure the pm-state repo (first-run bootstrap). */
+    bootstrap: (req: unknown) => ipcRenderer.invoke('config:bootstrap', req),
     /** Validate a token + repo before saving. */
     test: (cfg: unknown) => ipcRenderer.invoke('config:test', cfg),
     /** Save config (token encrypted in main); takes effect without restart. */