Drop Step 2 "Generate Secrets" (secrets move to pre-boot helper script per D-05), rework Step 2 to collect non-secret config via form fields (app URL, OIDC issuer, client_id, VAPID public key) written to app_config per D-02, and reduce wizard from 5 steps to 4. All design tokens, surfaces, and a11y contracts unchanged. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>