fix(cli): avoid Anthropic preflight during onboarding

Keep first-run CLI setup local-first by building only local onboarding steps.
Remove the startup preflight that pinged Anthropic/OAuth endpoints before any explicit login or model request.

Fixes #859.

Tested: bun test src/components/onboardingSteps.test.ts
Tested: bun run check:server
Not-tested: bun run verify; check:coverage; check:policy
Confidence: high
Scope-risk: narrow

src/components/onboardingSteps.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from 'bun:test'
+import { buildLocalOnboardingStepIds } from './onboardingSteps.js'
+
+describe('buildLocalOnboardingStepIds', () => {
+  test('keeps first-run CLI onboarding free of Anthropic network steps', () => {
+    const steps = buildLocalOnboardingStepIds({
+      apiKeyNeedsApproval: false,
+      offerTerminalSetup: false,
+    })
+
+    expect(steps).toEqual(['theme', 'security'])
+    expect(steps).not.toContain('preflight')
+    expect(steps).not.toContain('oauth')
+  })
+
+  test('preserves local-only optional onboarding steps', () => {
+    expect(
+      buildLocalOnboardingStepIds({
+        apiKeyNeedsApproval: true,
+        offerTerminalSetup: true,
+      }),
+    ).toEqual(['theme', 'api-key', 'security', 'terminal-setup'])
+  })
+})

src/components/onboardingSteps.ts

@@ -0,0 +1,29 @@
+export type LocalOnboardingStepId =
+  | 'theme'
+  | 'api-key'
+  | 'security'
+  | 'terminal-setup'
+
+type BuildLocalOnboardingStepIdsOptions = {
+  apiKeyNeedsApproval: boolean
+  offerTerminalSetup: boolean
+}
+
+export function buildLocalOnboardingStepIds({
+  apiKeyNeedsApproval,
+  offerTerminalSetup,
+}: BuildLocalOnboardingStepIdsOptions): LocalOnboardingStepId[] {
+  const steps: LocalOnboardingStepId[] = ['theme']
+
+  if (apiKeyNeedsApproval) {
+    steps.push('api-key')
+  }
+
+  steps.push('security')
+
+  if (offerTerminalSetup) {
+    steps.push('terminal-setup')
+  }
+
+  return steps
+}