Problem

Two user-facing quality issues discovered during manual testing:

CLI update command fragility

After a partial uninstall (containers/volumes/images removed, but config dir + binary retained), synthorg update reports "Container images already at 0.3.10" because it only checks state.ImageTag == tag in config -- it never verifies Docker state matches. Additionally, after upgrading images (e.g., 0.3.10 -> 0.4.0), old images are left behind; only uninstall offers cleanup.

Repro:

1. synthorg init + synthorg start
2. synthorg uninstall (partial -- remove containers/volumes/images but keep config)
3. synthorg update -- reports "already at X" despite no images existing

Setup wizard UX is fundamentally broken

Multiple UX failures in the first-run wizard:

1. Admin step allows going back after creation -- form shows empty again, no pre-fill
2. Admin step vanishes on refresh because needs_admin flips to false -- step count changes, indices shift
3. Provider discovery inconsistency -- probe_preset_urls() finds models (skips SSRF) but discover_models() returns 0 (blocks localhost/private IPs via SSRF validation). Local providers like Ollama always fail discovery.
4. Back button navigates to wrong place -- from provider config goes to Welcome instead of provider selector
5. Can't change provider once created -- preset cards are hidden, no way to reset
6. Password fields lack show/hide toggles and have autocomplete issues

Solution

CLI

• Add dirty state detection (missing compose, images, config, secrets) with user-choice recovery
• Add old image cleanup after successful upgrade (list non-current images, offer removal)

Setup Wizard

• Store-driven step completion tracking (completedSteps map synced from backend status)
• Always show all 5 steps (admin never disappears)
• Completed steps show read-only summaries (admin: locked, provider/company/agent: editable)
• Free navigation to any completed step via step indicators
• Fix SSRF: skip validation for preset-hinted discovery (trusted hardcoded URLs)
• Re-fetch /setup/status after each step completion
• Provider: "Change Provider" button, internal back nav to preset selector
• Password: show/hide toggles + autocomplete attribute fixes