Add welcome surface and user default surface preference

- Create welcome surface: topbar + getting-started card shown when
  no extension surfaces are installed. Admins see a link to Packages,
  non-admins see a message to contact their administrator.
- Update resolveDefaultSurface priority chain:
  user preference → global config → first extension → /welcome
- Register welcome as a core surface with authenticated auth
- Final fallback is now /welcome instead of /admin, breaking the
  infinite back-button loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/templates/base.html

@@ -89,6 +89,7 @@
         {{if eq .Surface "admin"}}{{template "surface-admin" .}}
         {{else if eq .Surface "team-admin"}}{{template "surface-team-admin" .}}
         {{else if eq .Surface "settings"}}{{template "surface-settings" .}}
+        {{else if eq .Surface "welcome"}}{{template "surface-welcome" .}}
         {{else if and .Manifest (eq .Manifest.Source "extension")}}{{template "surface-extension" .}}
         {{else}}<div style="padding:20px">Unknown surface: {{.Surface}}</div>
         {{end}}
@@ -123,6 +124,7 @@
     {{if eq .Surface "admin"}}{{template "scripts-admin" .}}{{end}}
     {{if eq .Surface "team-admin"}}{{template "scripts-team-admin" .}}{{end}}
     {{if eq .Surface "settings"}}{{template "scripts-settings" .}}{{end}}
+    {{if eq .Surface "welcome"}}{{template "scripts-welcome" .}}{{end}}
     {{/* v0.27.0: Extension surface JS — loaded from /surfaces/{id}/js/main.js */}}
     {{if and .Manifest (eq .Manifest.Source "extension")}}
     <script type="module" nonce="{{.CSPNonce}}" src="{{.BasePath}}/surfaces/{{.Surface}}/js/main.js?v={{.Version}}"></script>

server/pages/templates/surfaces/welcome.html

@@ -0,0 +1,25 @@
+{{/*
+    Welcome surface — shown when no extension surfaces are installed.
+    Renders topbar + welcome card with getting-started info.
+*/}}
+
+{{define "surface-welcome"}}
+<div id="welcome-mount" style="display:flex;flex-direction:column;height:100%;"></div>
+{{end}}
+
+{{define "scripts-welcome"}}
+<script type="module" nonce="{{.CSPNonce}}">
+    const { h, render } = await import('{{.BasePath}}/js/sw/vendor/preact.module.js');
+    const hooksModule = await import('{{.BasePath}}/js/sw/vendor/hooks.module.js');
+    const { default: htm } = await import('{{.BasePath}}/js/sw/vendor/htm.module.js');
+    const html = htm.bind(h);
+    window.preact = window.preact || { h, render };
+    window.hooks = window.hooks || hooksModule;
+    window.html = window.html || html;
+
+    const { boot } = await import('{{.BasePath}}/js/sw/sdk/index.js?v={{.Version}}');
+    await boot();
+
+    await import('{{.BasePath}}/js/sw/surfaces/welcome/index.js?v={{.Version}}');
+</script>
+{{end}}