improvement(self-host): gate email verification on a mail provider, add self-host settings, land setup on signup (#6216)

* fix(auth): skip email verification when no mail provider is configured

Signup pushed /verify unconditionally, stranding self-hosted deployments
with no mail provider on a screen no email could ever satisfy. Derive one
server-side effective value (verification enabled AND deliverable) and read
it from Better Auth enforcement, signup routing, and the verify page.

* feat(settings): add a self-host section with the managed Chat keys link

Self-hosters had no in-app pointer to the managed service that issues their
Chat keys. New Settings > System > Self-host section, gated on `requiresSelfHosted`
so it is absent on hosted Sim, containing only that link.

* improvement(setup): land the wizard handoff on signup

A freshly provisioned deployment has no accounts and / renders the marketing
landing page, so the bare origin left operators hunting for the CTA. Single-source
the URLs and point every open-Sim handoff at /signup across all three modes.

* improvement(settings): mark the self-host section with a sprout

Server was already doing double duty for MCP servers and Mothership, and the
icon set ships no botanical glyph, so the mark is a text emoji.

* improvement(settings): draw the sprout as an emcn line icon, move to Platform

The emoji rendered in the platform's own colors, so it was the one glyph in the
nav that ignored --text-icon. Replaced with a hand-drawn emcn Sprout (24 grid,
1.55 stroke, currentColor) matching the house style, renamed the tab to
Self hosting, and regrouped it under Platform — self-hosting is deployment-wide,
not per-workspace. Still self-hosted-only.

* improvement(settings): drop the section header from self hosting

One row does not need a section label, and removing it takes the divider with
it. The body is now the Chat keys row and its managed-keys link, nothing else.

scripts/setup/wizard.ts

@@ -9,6 +9,7 @@ import { runK8sMode } from './modes/k8s.ts'
 import { ensurePortsFree } from './ports.ts'
 import * as p from './prompter.ts'
 import { glyph, theme } from './theme.ts'
+import { APP_SIGNUP_URL } from './urls.ts'
 
 export type WizardMode = 'compose' | 'dev' | 'k8s'
 
@@ -159,10 +160,9 @@ export async function runWizard(flags: WizardFlags): Promise<void> {
 
   if (mode !== 'k8s' && !startDevNow) await finalVerify()
 
-  const url = 'http://localhost:3000'
   p.note(
     [
-      mode === 'k8s' ? `port-forward, then open ${url}` : `open ${url}`,
+      mode === 'k8s' ? `port-forward, then open ${APP_SIGNUP_URL}` : `open ${APP_SIGNUP_URL}`,
       'manage it:  bun run sim start · stop · status · logs',
       'check your setup:  bun run sim doctor',
       mode === 'dev' && !startDevNow ? `start Sim:  bun run ${devScript}` : null,
@@ -175,7 +175,7 @@ export async function runWizard(flags: WizardFlags): Promise<void> {
   p.outro(theme.accent('Sim is ready.'))
 
   if (mode === 'compose' && process.platform === 'darwin') {
-    spawnSync('open', [url], { stdio: 'ignore' })
+    spawnSync('open', [APP_SIGNUP_URL], { stdio: 'ignore' })
   }
   if (startDevNow) {
     // dev:full binds 3000 (app) and 3002 (realtime) — resolve any conflict