Fix private appliance onboarding UX

[keegreil]

Summary

• redirect setup as soon as the operational dashboard API is available
• show the native SV2 endpoint on setup completion and prominently on the live map
• add an explicit trusted private-dashboard mode for read-only operator diagnostics behind appliance authentication
• keep destructive admin APIs authenticated and default the private mode off

Validation

• 237 .NET tests passed
• 24 dashboard tests passed
• dashboard production build passed
• test Umbrel deployment will remain package-pinned until the image build completes