feat: overhaul the openwiki --init setup wizard

[Colin Francis (colifran)]

Summary

Overhauls the openwiki --init first-run wizard and covers the following four items:

1. Trustworthy checklist: rows now read from in-session state instead of process.env so each step flips to a green ✓ the moment you complete it. Adds a ✓ / ❯ / ○ glyph column and two grouped sections (Detected / Set up). Secrets render as dots and never a full key or env path.
2. In-wizard navigation: Esc steps back through the config steps, Enter walks forward sequentially rather than jumping to the next unset step, and each field is seeded from state on arrival so values survive back-and-forth. Empty-submit keeps an existing key and switching providers clears the previous provider's credentials so nothing carries over.
3. Credential-source visibility: shell env keeps winning at runtime, but it's now visible to the user and saveOpenWikiEnv now defers to a shell var so init and later runs agree, a yellow banner lists any wizard managed key detected in the shell, and the provider key row reads from shell
4. Failure UX: the ~40-line credential dump is now gated behind --debug / OPENWIKI_DEBUG. Auth failures (401/403 or an auth-keyword message) instead show a concise "How to fix" message that names a shell-shadowed key to unset.
5. Init is now reconfigurable since it idempotently walks through your config settings allowing you to reconfigure if you need to (this resolves peoples ask for a separate config option)

Tests

1. New unit coverage
2. Manual e2e verified in 5 phases: fresh walk; always-open idempotent re-walk; full Esc navigation through the personal tail; shell precedence never leaking into saved config; and the auth failure panel + --debug.

Demo

Screen.Recording.2026-07-17.at.8.23.14.AM.mov

Resolves: #23