Ask for a provider key in first-run setup #566

The first-run dialog (#553) checks Tailscale and gh but never asks for a model provider key. A new install lands on the dashboard, and its first message to an agent fails. The composer then says "Add a provider to use Ace. You can still send messages in Chat mode" (apps/app/src/composer.tsx:302), or an invocation toast links to Providers (apps/app/src/app.tsx:610). #488 asked for setup to offer this; #517 added the notice but not a setup step.

Proposal: a step after the checks. Pick Anthropic or OpenAI, paste a key, check it with the request Settings → Providers already makes, then save it to Keychain. If an environment key is already set, the step says so and passes. Chat only for now skips the step.

The step should also say whose key pays. An agent runs on the host that owns its channel, with that owner's key, so invoking an agent in a teammate's shared channel uses the teammate's key. Cloud workspaces use the key in the compute Worker's secrets instead.

Every teammate hits this. It's gap g16 on the onboarding map. Part of #550.