fix(audit): kill fake install cmds + dead demo CTA; production fonts; scoped error boundary; admin bootstrap seed

Full-site fake-data audit findings:
- SetupWizard showed a curl|sh installer (get.corrosionmgmt.com) and a
  'corrosion-agent' binary that don't exist -> real host-agent commands
- 'View live demo' CTA on 5 marketing pages linked to a login, not a
  demo -> honest 'Sign in'
- Google Fonts @import was silently dropped from the production CSS
  bundle (mid-bundle @import) -> <link> tags in index.html; prod was
  shipping system fallback fonts
- App-root ErrorBoundary bricked the entire SPA (incl. marketing) on a
  single failed fetch until manual reload -> resets on route change +
  content-scoped boundary inside DashboardLayout so nav chrome survives
- Status page KPIs showed fake zeros while the fetch failed -> em dash
- Login lacked the forgot-password link (flow already existed end-to-end)
- AdminSeedService: fresh DB had schema but no login possible; seeds
  super-admin + license from ADMIN_* env when users table is empty

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/views/auth/LoginView.vue

@@ -191,6 +191,8 @@ function handleBackToLogin() {
       <p v-if="!showTotpInput" class="auth-footer">
         No account?
         <router-link to="/register" class="auth-footer__link">Create one</router-link>
+        ·
+        <router-link to="/forgot-password" class="auth-footer__link">Forgot password?</router-link>
       </p>
     </div>
   </div>

frontend/src/views/auth/SetupWizardView.vue

@@ -196,14 +196,17 @@ async function completeSetup() {
         </div>
 
         <div class="setup-code">
-          <p class="setup-code__comment"># Download and install the Corrosion host agent</p>
-          <p class="setup-code__cmd">curl -sSL https://get.corrosionmgmt.com | sh</p>
-          <p class="setup-code__comment setup-code__comment--mt"># Start the agent with your license key</p>
-          <p class="setup-code__cmd">corrosion-agent start --key {{ auth.license?.license_key ?? 'YOUR-LICENSE-KEY' }}</p>
+          <p class="setup-code__comment"># Download the Corrosion host agent (Linux)</p>
+          <p class="setup-code__cmd">curl -LO https://cdn.corrosionmgmt.com/host-agent/latest/corrosion-host-agent-linux-amd64</p>
+          <p class="setup-code__cmd">chmod +x corrosion-host-agent-linux-amd64</p>
+          <p class="setup-code__comment setup-code__comment--mt"># Start with your license key</p>
+          <p class="setup-code__cmd">export LICENSE_ID="{{ auth.license?.license_key ?? 'YOUR-LICENSE-KEY' }}"</p>
+          <p class="setup-code__cmd">export NATS_URL="nats://nats.corrosionmgmt.com:4222"</p>
+          <p class="setup-code__cmd">./corrosion-host-agent-linux-amd64</p>
         </div>
 
         <p class="setup-hint">
-          The agent auto-registers with your panel. You can also use the uMod plugin for lightweight integration.
+          On Windows, download the agent from the Server page after setup. The agent connects outbound and auto-registers with your panel.
         </p>
 
         <div class="setup-actions">
@@ -235,7 +238,7 @@ async function completeSetup() {
           </svg>
         </div>
         <h1 class="setup-card__title">You're all set</h1>
-        <p class="setup-card__sub">Your server is configured. Head to the dashboard to start managing your Rust server.</p>
+        <p class="setup-card__sub">Your server is configured. Head to the dashboard to start managing your game server.</p>
         <Button
           type="button"
           :loading="isLoading"

frontend/src/views/marketing/EarlyAccessView.vue

@@ -291,7 +291,7 @@ onUnmounted(() => { io?.disconnect() })
           Sign up above
         </a>
         <a class="btn btn--ghost btn--lg" :href="panelUrl + '/login'">
-          <Icon name="play" :size="17" />View live demo
+          <Icon name="key" :size="17" />Sign in
         </a>
       </div>
     </div>

frontend/src/views/marketing/HowItWorksView.vue

@@ -350,7 +350,7 @@ onUnmounted(() => { io?.disconnect() })
           Join early access
         </RouterLink>
         <a class="btn btn--ghost btn--lg" :href="panelUrl + '/login'">
-          <Icon name="play" :size="17" />View live demo
+          <Icon name="key" :size="17" />Sign in
         </a>
       </div>
     </div>

frontend/src/views/marketing/LandingView.vue

@@ -113,7 +113,7 @@ const mockActiveGame = activeGame
           Join early access
         </RouterLink>
         <a class="btn btn--ghost btn--lg" :href="panelUrl + '/login'">
-          <Icon name="play" :size="17" />View live demo
+          <Icon name="key" :size="17" />Sign in
         </a>
       </div>
       <!-- Game pills -->
@@ -672,7 +672,7 @@ const mockActiveGame = activeGame
           Join early access
         </RouterLink>
         <a class="btn btn--ghost btn--lg" :href="panelUrl + '/login'">
-          <Icon name="play" :size="17" />View live demo
+          <Icon name="key" :size="17" />Sign in
         </a>
       </div>
     </div>

frontend/src/views/marketing/PricingView.vue

@@ -351,7 +351,7 @@ const plans: Plan[] = [
           Join early access
         </RouterLink>
         <a class="btn btn--ghost btn--lg" :href="panelUrl + '/login'">
-          <Icon name="play" :size="17" />View live demo
+          <Icon name="key" :size="17" />Sign in
         </a>
       </div>
     </div>

frontend/src/views/marketing/RoadmapView.vue

@@ -224,7 +224,7 @@ onUnmounted(() => { io?.disconnect() })
           Join early access
         </RouterLink>
         <a class="btn btn--ghost btn--lg" :href="panelUrl + '/login'">
-          <Icon name="play" :size="17" />View live demo
+          <Icon name="key" :size="17" />Sign in
         </a>
       </div>
     </div>

frontend/src/views/public/StatusPageView.vue

@@ -41,12 +41,8 @@ interface StatusResponse {
 
 const api = useApi()
 const servers = ref<ServerStatus[]>([])
-const platformHealth = ref<PlatformHealth>({
-  total_servers: 0,
-  online_servers: 0,
-  total_players: 0,
-  uptime_percent: 0,
-})
+// null until the first successful fetch — KPIs render '—', never fake zeros
+const platformHealth = ref<PlatformHealth | null>(null)
 
 const searchQuery = ref('')
 const loading = ref(true)
@@ -148,10 +144,10 @@ onUnmounted(() => {
 
     <!-- Platform KPIs -->
     <div v-if="!loading" class="sp-kpis">
-      <StatCard icon="server"       label="Total servers"   :value="String(platformHealth.total_servers)" />
-      <StatCard icon="activity"     label="Online now"       :value="String(platformHealth.online_servers)" />
-      <StatCard icon="users"        label="Total players"    :value="String(platformHealth.total_players)" />
-      <StatCard icon="trending-up"  label="Platform uptime"  :value="safeFixed(platformHealth.uptime_percent, 1)" unit="%" />
+      <StatCard icon="server"       label="Total servers"   :value="platformHealth ? String(platformHealth.total_servers) : '—'" />
+      <StatCard icon="activity"     label="Online now"       :value="platformHealth ? String(platformHealth.online_servers) : '—'" />
+      <StatCard icon="users"        label="Total players"    :value="platformHealth ? String(platformHealth.total_players) : '—'" />
+      <StatCard icon="trending-up"  label="Platform uptime"  :value="safeFixed(platformHealth?.uptime_percent ?? null, 1, '—')" unit="%" />
     </div>
 
     <!-- Body -->