feat: initialize panel access before linking Minecraft accounts

Configure connection and storage before creating or resuming the one-time Owner login. Remove Minecraft prerequisites from setup and preserve established login credentials.

Let staff preview and confirm roles from configured authentication sources using the existing account-link storage and game UUID mapping. Retain in-game code proof for players, add client-version and lobby guidance, and support NodePort passkey origins.

internal/api/handlers_setup.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 )
 
-// Setup-token redemption (spec §B setup bootstrap). The `felis setup` MC-bind
+// Setup-token redemption (spec §B setup bootstrap). The `felis setup` host bootstrap
 // flow mints a one-time token and prints a URL like:
 //
 //	https://op.console.<root>/setup?token=<raw>
@@ -58,7 +58,7 @@ func (a *API) handleSetupRedeem(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Hash the raw token — only the hash is stored (mirroring session cookies and
-	// setup token creation in performSetupMCBind).
+	// setup token creation in performSetupOwner).
 	sum := sha256.Sum256([]byte(token))
 	tokenHash := hex.EncodeToString(sum[:])