Add welcome surface and user default surface preference

- Create welcome surface: topbar + getting-started card shown when
  no extension surfaces are installed. Admins see a link to Packages,
  non-admins see a message to contact their administrator.
- Update resolveDefaultSurface priority chain:
  user preference → global config → first extension → /welcome
- Register welcome as a core surface with authenticated auth
- Final fallback is now /welcome instead of /admin, breaking the
  infinite back-button loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/pages.go

@@ -244,6 +244,11 @@ func (e *Engine) registerCoreSurfaces() {
 			Title: "Workflow Landing", Template: "workflow-landing", Auth: "public",
 			Layout: "single", Source: "core",
 		},
+		{
+			ID: "welcome", Route: "/welcome",
+			Title: "Welcome", Template: "surface-welcome", Auth: "authenticated",
+			Layout: "single", Source: "core",
+		},
 	}
 }