…air local device (#537, #538, #540)

Three init wizard fixes for the 0.10.1 milestone:

- #537: Security posture step now asks "Who will interact with this
  Netclaw instance?" instead of asking about access method. Stripped
  parenthetical transport hints from Team/Public option labels.

- #538: Moved exposure mode step from position 3 to second-to-last
  (before health check). Natural inside-out order: who trusts it →
  where it talks → what it does → how to reach it.

- #540: Auto-register the local machine as a paired device during
  init when a non-Local exposure mode is selected. Generates a
  bootstrap device token, writes the hash to devices.json and the
  raw token to secrets.json. This satisfies ExposureModeValidationService's
  requirement of at least one paired device, fixing the chicken-and-egg
  problem where the daemon crashed on first boot because the pairing
  flow requires a running daemon.

Two root causes prevented Up/Down arrows and A/D keys from working
on the Channels step:

1. Stale IFocusable components (SelectionListNode, TextInputNode) from
   prior wizard steps remained on Termina's focus stack, consuming keys
   before they reached the Channels view's custom handler. Fixed by
   overriding HandlePageInput to intercept Channels keys at the capture
   phase, before the focus manager routes them.

2. The DynamicLayoutNode rebuild callback called ClearFocusState() on
   every content invalidation, resetting _addMode and _cursorIndex.
   This meant pressing 'A' would enter add mode but immediately reset
   it when InvalidateAndRedraw triggered a layout rebuild. Fixed by
   skipping ClearFocusState for the Channels step, which manages its
   own state across invalidations.

Also promotes Ctrl+Q to the capture phase so it always triggers shutdown
even when a TextInputNode has focus.

Adds headless TUI tests using VirtualInputSource that exercise the full
Termina rendering and input-routing pipeline for the Channels step.