Setup and invitations: the first login made from the client, everyone else by a group's invitation

PrivaPub's sign-up is closed. While it has no administrator, Login offers /setup, where the first login is made with its
first persona and becomes the administrator (PrivaPub's /clientapi/user/setup; owner decision 2026-10-16: first come,
first served, and setup then closes for good). Everyone else joins at /join?code=: a group's invitation makes the login,
and its first persona joins the group (/clientapi/user/invitation/signup). Login links there, and a group's page shows
the link next to its code. A login without a persona is sent from Login to Settings instead of a dead end. Login, setup
and join share AuthService's StartSession, and all three go without credentials.

e2e (Login/SignUpTests, against the pasture): setup offered on Login, made, the feed reached with Administration, then a
signed-out reader is offered sign-in and invitations only; an invitation link makes a login whose persona joins the
circle. The phone sweep covers /setup and /join: login, setup and join fit every portrait phone, and AccountTests signs
in through the changed Login. The town's signed-in tests were not rerun: today's pasture came up without Mastodon, and
its town seed left stale sessions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ClientJsonContext.cs

@@ -32,6 +32,9 @@ namespace decePubClient;
 [JsonSerializable(typeof(ValidationErrors))]
 [JsonSerializable(typeof(WebResult))]
 [JsonSerializable(typeof(LoginForm))]
+[JsonSerializable(typeof(SetupForm))]
+[JsonSerializable(typeof(InvitationLoginForm))]
+[JsonSerializable(typeof(ViewServerSetup))]
 [JsonSerializable(typeof(UserPasswordForm))]
 [JsonSerializable(typeof(RemoveSelfForm))]
 [JsonSerializable(typeof(JwtUser))]