Make a branded first-run preflight the single setup surface for keys and delivery

[tomvaillant]

Problem

Provider keys and delivery configuration are discovered too late and through separate flows. Fly availability, for example, is only surfaced after a visual has been approved and the export menu is emitted.

Splash already has a local browser configurator in install/configurator.ts for runtime choice, MapTiler, Datawrapper, Anthropic, and optional Fly fields. It should become the branded, single first-run preflight rather than adding more terminal questions or provider-specific setup fragments.

@rmdms

Suggested solution

Turn the existing localhost configurator into a branded Splash setup and readiness page that opens before the first orchestration.

The page should collect and validate:

• Preferred orchestration/output language and newsroom profile basics.
• Optional provider capabilities: MapTiler, Datawrapper, image/AI services, and any future producer credentials.
• Delivery method and host configuration: newsroom CMS integration, Fly, or another selected publisher adapter.
• Required app/project/site identifiers in addition to tokens.
• Which capabilities the journalist wants enabled, so intentionally unused providers do not appear as failures.

On submit, one deterministic script should:

1. Validate every enabled capability with a non-destructive provider check.
2. Save secrets to the protected .env path and non-secret preferences to the newsroom profile/settings file.
3. Run the same dependency and capability preflight the spine uses later.
4. Show a concise readiness summary with clear remediation links.
5. Exit successfully and start the first Splash orchestration only when the selected capabilities are ready.

When a later production plan needs an unconfigured capability, the spine should reopen this page directly at the relevant section, then resume the pending orchestration after successful submission.

UX and security requirements

• Use Splash branding and plain newsroom language, not environment-variable terminology as the primary labels.
• Explain where each key is obtained with a direct provider link and minimal steps.
• Never send credentials off the machine except to the provider verification endpoint.
• Never write secrets into SKILL.md, NEWSROOM-PROFILE.md, reports, logs, or generated artifacts.
• Keep .env permissions restricted and redact secrets from errors.
• Provide a headless fallback that prints the local URL and exact setup command.

Acceptance criteria

• A first-time journalist completes one browser setup flow, submits it, and Splash begins the first orchestration.
• Language, provider, and delivery readiness are checked before CADRAGE.
• Fly or another embed host is not first discovered at export time.
• A missing capability reopens the relevant setup section and resumes the same run after validation.
• Existing configurator installations migrate without losing .env values.
• Tests cover enabled/disabled providers, invalid and unreachable credentials, secure persistence, resume behavior, and no-GUI operation.