feat(tenant): hide setup/settings surfaces when HELIX_SETUP_MANAGED

Ramaiah's product team owns their setup; end-user admins shouldn't see a dead-end Settings nav + Resume Setup banner. Flag is read from /api/config/ui-flags at app boot.

- use-ui-flags: module-scoped cache + useUiFlags hook + getUiFlags
  helper for non-component callers
- main.tsx: /setup redirects when managed; RequireSelfServeSetup
  guard blocks /settings/*
- resume-setup-banner: suppressed when managed
- login.tsx: skip first-run /setup redirect when managed
- settings.tsx: remove orphan popup-modal scaffolding left over
  from an earlier 'contact product team' approach
- section-card: support onClick-or-href (kept for future use)

src/hooks/use-ui-flags.ts

@@ -0,0 +1,50 @@
+import { useEffect, useState } from 'react';
+import { apiClient } from '@/lib/api-client';
+
+// Per-tenant UI flags the sidecar controls via env vars. Read once at
+// app mount; cached in module scope so every consumer gets the same
+// snapshot without re-fetching. Safe defaults when the sidecar doesn't
+// respond (all flags off) so the UI stays functional.
+export type UiFlags = {
+    setupManaged: boolean;
+};
+
+const DEFAULT_FLAGS: UiFlags = {
+    setupManaged: false,
+};
+
+let cachedFlags: UiFlags | null = null;
+let inflight: Promise<UiFlags> | null = null;
+
+export const getUiFlags = (): Promise<UiFlags> => fetchFlags();
+
+const fetchFlags = (): Promise<UiFlags> => {
+    if (cachedFlags) return Promise.resolve(cachedFlags);
+    if (inflight) return inflight;
+    inflight = apiClient
+        .get<UiFlags>('/api/config/ui-flags', { silent: true })
+        .then((res) => {
+            cachedFlags = { ...DEFAULT_FLAGS, ...res };
+            return cachedFlags;
+        })
+        .catch(() => {
+            cachedFlags = { ...DEFAULT_FLAGS };
+            return cachedFlags;
+        })
+        .finally(() => {
+            inflight = null;
+        });
+    return inflight;
+};
+
+export const useUiFlags = (): UiFlags => {
+    const [flags, setFlags] = useState<UiFlags>(cachedFlags ?? DEFAULT_FLAGS);
+    useEffect(() => {
+        if (cachedFlags) {
+            setFlags(cachedFlags);
+            return;
+        }
+        fetchFlags().then(setFlags);
+    }, []);
+    return flags;
+};