Add welcome surface and user default surface preference

- Create welcome surface: topbar + getting-started card shown when
  no extension surfaces are installed. Admins see a link to Packages,
  non-admins see a message to contact their administrator.
- Update resolveDefaultSurface priority chain:
  user preference → global config → first extension → /welcome
- Register welcome as a core surface with authenticated auth
- Final fallback is now /welcome instead of /admin, breaking the
  infinite back-button loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/templates/base.html

@@ -89,6 +89,7 @@
         {{if eq .Surface "admin"}}{{template "surface-admin" .}}
         {{else if eq .Surface "team-admin"}}{{template "surface-team-admin" .}}
         {{else if eq .Surface "settings"}}{{template "surface-settings" .}}
+        {{else if eq .Surface "welcome"}}{{template "surface-welcome" .}}
         {{else if and .Manifest (eq .Manifest.Source "extension")}}{{template "surface-extension" .}}
         {{else}}<div style="padding:20px">Unknown surface: {{.Surface}}</div>
         {{end}}
@@ -123,6 +124,7 @@
     {{if eq .Surface "admin"}}{{template "scripts-admin" .}}{{end}}
     {{if eq .Surface "team-admin"}}{{template "scripts-team-admin" .}}{{end}}
     {{if eq .Surface "settings"}}{{template "scripts-settings" .}}{{end}}
+    {{if eq .Surface "welcome"}}{{template "scripts-welcome" .}}{{end}}
     {{/* v0.27.0: Extension surface JS — loaded from /surfaces/{id}/js/main.js */}}
     {{if and .Manifest (eq .Manifest.Source "extension")}}
     <script type="module" nonce="{{.CSPNonce}}" src="{{.BasePath}}/surfaces/{{.Surface}}/js/main.js?v={{.Version}}"></script>