release: v0.2.37 — zero-argument startup, first-run wizard, real download progress

Startup no longer needs arguments: the config is created on first launch, a busy
port is swapped for a free one, the console is open by default, and the browser
lands on a setup wizard that downloads a ready-made .cmf model and wires it into
routing (managed server + routing.default) when you press Finish.

Download progress was reported from curl's own meter, which prints a full
0→100% bar for the -L redirect hop before the transfer starts — so every job
showed 100% and then hung. Progress now comes from bytes on disk against the
size from the HuggingFace tree (or a HEAD request).

The UI and the gateway also disagreed about the output file name, so a finished
download never marked its card as downloaded; the gateway now returns the exact
stem and the UI sends it back verbatim for download, progress and delete.

Featured models are read live from the infosave HF account in both the wizard
and Import, and all 432 UI strings now exist in every one of the 7 languages.

web/js/api.js

@@ -19,7 +19,10 @@ export function setToken(tok) {
 }
 
 async function j(method, path, body) {
-  const opt = { method, headers: { Authorization: "Bearer " + getToken() } };
+  const tok = getToken();
+  const headers = {};
+  if (tok) headers["Authorization"] = "Bearer " + tok;
+  const opt = { method, headers };
   if (body !== undefined) {
     opt.headers["content-type"] = "application/json";
     opt.body = JSON.stringify(body);
@@ -114,14 +117,32 @@ export const api = {
   deleteImport: (job) => j("DELETE", "/import/" + encodeURIComponent(job)),
   registerImport: (job) =>
     j("POST", "/import/" + encodeURIComponent(job) + "/register"),
+
+  // first-run onboarding
+  setupStatus: () => j("GET", "/setup/status"),
+  // Connects every finished download as a local model unless register === false.
+  setupComplete: (lang, register) => j("POST", "/setup/complete", { lang, register }),
+  setupFeatured: () => j("GET", "/setup/featured"),
+  // `name` is the exact output stem from setup/featured — it wins over the
+  // repo/variant guess so the delete always hits the file the download wrote.
+  deleteSetupFile: (repo, variant, name) =>
+    j(
+      "DELETE",
+      `/setup/file?repo=${encodeURIComponent(repo)}` +
+        (variant ? `&variant=${encodeURIComponent(variant)}` : "") +
+        (name ? `&name=${encodeURIComponent(name)}` : "")
+    ),
 };
 
 // Streaming playground: POST /test/stream, calls onDelta(text) per content chunk,
 // returns the routing decision read from X-Cortiq-* response headers.
 export async function testStream(body, onDelta) {
+  const tok = getToken();
+  const headers = { "content-type": "application/json" };
+  if (tok) headers["Authorization"] = "Bearer " + tok;
   const r = await fetch(BASE + "/test/stream", {
     method: "POST",
-    headers: { Authorization: "Bearer " + getToken(), "content-type": "application/json" },
+    headers,
     body: JSON.stringify(body),
   });
   if (r.status === 401) {