Setup and invitations: the first login made from the client, everyone else by a group's invitation

PrivaPub's sign-up is closed. While it has no administrator, Login offers /setup, where the first login is made with its
first persona and becomes the administrator (PrivaPub's /clientapi/user/setup; owner decision 2026-10-16: first come,
first served, and setup then closes for good). Everyone else joins at /join?code=: a group's invitation makes the login,
and its first persona joins the group (/clientapi/user/invitation/signup). Login links there, and a group's page shows
the link next to its code. A login without a persona is sent from Login to Settings instead of a dead end. Login, setup
and join share AuthService's StartSession, and all three go without credentials.

e2e (Login/SignUpTests, against the pasture): setup offered on Login, made, the feed reached with Administration, then a
signed-out reader is offered sign-in and invitations only; an invitation link makes a login whose persona joins the
circle. The phone sweep covers /setup and /join: login, setup and join fit every portrait phone, and AccountTests signs
in through the changed Login. The town's signed-in tests were not rerun: today's pasture came up without Mastodon, and
its town seed left stale sessions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/e2e/Mobile/Routes.cs

@@ -72,6 +72,8 @@ namespace decePubClient.E2E.Mobile
 				await OpenEveryCollapse(page);
 			}, () => Admin, Screens: 30),
 			new("login", async (page, _) => await Visit(page, "/login"), SignedOut: true),
+			new("setup", async (page, _) => await Visit(page, "/setup"), SignedOut: true),
+			new("join", async (page, _) => await Visit(page, "/join"), SignedOut: true),
 			new("styleguide", async (page, _) => await Visit(page, "/styleguide"), SignedOut: true, Screens: 40, Gating: false)
 		];