Core: SaaS first-run onboarding (Vault LLM BYOK, no GGUF/Ollama)

[ReBoticsAI]

Problem

FirstRunWizard is local-first today: GGUF / Ollama / models directory, with no INSTALLATION_SURFACE=saas branching. Choosing Use cloud API (Vault) only flips a flag; it does not guide a cloud-first setup.

Goal

For SaaS / cloud installs:

• Hide local model paths (GGUF, Ollama, models directory)
• Guided OpenAI / Anthropic / Cursor setup into Vault (BYOK)
• Land the user Ready into Chat

Keep the existing local wizard for developer_source, Electron, and private hub.

Related

• Core: Exa-backed web_search/fetch_url for Cloud (egress + BYOK) #218 — Exa BYOK is locked; timing TBD (onboarding vs first web-tool use). Coordinate so we do not force Exa keys before they are needed if that path wins.

Key files / surfaces

• apps/web/src/components/FirstRunWizard.tsx
• onboarding helpers (onboarding.ts and related)
• Vault (LLM provider credentials)
• health.saas / SaaS health probes as needed for readiness

Out of scope

• Finishing launch P0s (launch: Hostinger VPS + prod compose #194–launch: DNS cutover + checklist sign-off #200 and related). This issue is discussion / design for SaaS onboarding only; implementation can follow once launch blockers are clear.

Notes

Discussion only for now. Do not treat this as blocking launch P0 work.

[ReBoticsAI]

Related fix shipping in #227: SaaS tenants were skipping FirstRunWizard entirely after email verify (status probe 403 while unverified, gate never re-ran). Cloud wizard now shows a Vault BYOK step (no GGUF/Ollama). Full in-wizard key collection/validation remains on this issue.

[ReBoticsAI]

Progress: Cloud FirstRunWizard no longer shows GGUF/Ollama (#227); Open Vault / Back / Settings reopen (#228/#229). Remaining BYOK depth (named subscription + API-key cards, harness matrix) continues on #230 / #231 / #232. Keep this issue open until Vault guidance feels complete for Cloud, or close if we treat those three as the replacement scope.