20260826 - Backfill the wizard-completed flag so pre-June nodes can register

[Purple10101]

Re-lands the change merged as #72 on 2026-08-26 and lost off main 83 seconds
later. Same commit, rebased onto current main.

Why this is being opened again

gh pr view 72 still reports state=MERGED, mergeCommit=b86111a7, so every
signal says this shipped. It did not. The reflog:

17:42:02  origin/main  b86111a  fetch: fast-forward   <- merge of #72 arrives
17:43:23  origin/main  c9f98ec  update by push        <- main reset back

A force-push moved main back to c9f98ec, the merge's first parent, and took
b86111a and 55c2b63 with it. Nothing else was lost in that push. main has
carried no backfill_setup_wizard_completed since, and #73, which was the same
head commit, was closed as a duplicate of the merge that no longer existed.

Why it matters now

retina-telemetry gates registration on /data/retina-gui/setup-wizard-completed,
so a node cannot register while its config is still the shipped
Greenwich/Crystal Palace default. That gate landed in retina-telemetry 1f1b990
on the same day this was merged, was released in v0.2.1 on 2026-09-03, and
v0.2.1 is the current compose pin. It is running on the fleet now.

The flag itself only arrived in aee29a6 (2026-06-24). Every node that finished
the wizard before then has none and is refused registration permanently, which
is the exact failure the gate exists to prevent. The original commit message
said this "has to ship and deploy ahead of the telemetry side". It now has to
follow it instead.

What it does

Backfills the flag at startup for a node that finished setup before the flag
existed. The evidence is a location in user.yml, because that is the
override layer: the merged config.yml always carries a location, so one there
proves nothing, whereas an entry in user.yml means someone chose it.
/towers/select has written it since 4afa307 (2026-03-23), three months
before the flag, so every node in the gap is covered.

Deliberately not a coordinate check against the default. A node genuinely sited
near Greenwich would be refused registration for life, and it would make a
config default load-bearing across two repos.

An existing flag is never re-dated: it answers "when was setup finished", and a
backfill has not finished anything. The startup call is guarded because this is
the only thing that parses user.yml at import time, and an unparseable one
stopping the GUI booting is a worse failure than the missing flag.

Verification

• 880 tests pass locally on the rebased branch, 71 of them in
  tests/test_device_state.py.
• 8 new tests cover the configured node, the unconfigured node, empty and
  malformed configs, partial coordinates, 0 as a real coordinate, an existing
  flag keeping its timestamp, and an unwritable data dir.
• The original commit was verified on two live nodes, including one configured
  on 2026-06-30.

Worth deploying rather than only merging, since the nodes this repairs are the
ones already in the field.

🤖 Generated with Claude Code