feat(tenant): hide setup/settings surfaces when HELIX_SETUP_MANAGED

Ramaiah's product team owns their setup; end-user admins shouldn't see a dead-end Settings nav + Resume Setup banner. Flag is read from /api/config/ui-flags at app boot.

- use-ui-flags: module-scoped cache + useUiFlags hook + getUiFlags
  helper for non-component callers
- main.tsx: /setup redirects when managed; RequireSelfServeSetup
  guard blocks /settings/*
- resume-setup-banner: suppressed when managed
- login.tsx: skip first-run /setup redirect when managed
- settings.tsx: remove orphan popup-modal scaffolding left over
  from an earlier 'contact product team' approach
- section-card: support onClick-or-href (kept for future use)

src/pages/login.tsx

@@ -12,6 +12,7 @@ import { MaintOtpModal } from '@/components/modals/maint-otp-modal';
 import { useMaintShortcuts } from '@/hooks/use-maint-shortcuts';
 import { useThemeTokens } from '@/providers/theme-token-provider';
 import { getSetupState } from '@/lib/setup-state';
+import { getUiFlags } from '@/hooks/use-ui-flags';
 
 export const LoginPage = () => {
     const { loginWithUser } = useAuth();
@@ -118,11 +119,13 @@ export const LoginPage = () => {
 
             // First-run detection: if the workspace's setup is incomplete and
             // the wizard hasn't been dismissed, route the admin to /setup so
-            // they finish onboarding before reaching the dashboard. Failures
-            // are non-blocking — we always have a fallback to /.
+            // they finish onboarding before reaching the dashboard. Skip when
+            // the tenant's setup is product-team managed — there's nothing
+            // for the admin to do in the wizard. Failures are non-blocking —
+            // we always have a fallback to /.
             try {
-                const state = await getSetupState();
-                if (state.wizardRequired) {
+                const [state, flags] = await Promise.all([getSetupState(), getUiFlags()]);
+                if (state.wizardRequired && !flags.setupManaged) {
                     navigate('/setup');
                     return;
                 }