[LSWF] Local-only setup: skip all cloud steps (sunset)

[AustinChangLinksys]

[!warning] Trigger condition NOT finalized (conflict pending resolution)
This issue currently describes an unconditional local setup (skip cloud for everyone). But Jimmy's latest reply says the local-setup behavior should be "dependent only on the SKU/model list from the cloud" — i.e. driven by the whitelist, NOT unconditional. We also surfaced that remote access depends on cloud provisioning at setup time, so the clean model is: whitelisted models → normal cloud setup (so they stay remotely manageable); non-whitelisted → fully local setup. See the "same whitelist drives A + B" note in #1162.
The code as committed is unconditional (see below); it will likely need to change back to whitelist-driven once Jimmy confirms the provisioning decision. Do not treat the current implementation as final.

Background

As part of the cloud service sunset, the LSWF app (release-3.6.1) should make router setup skip all cloud steps (login / registration / provisioning) and complete entirely locally — mirroring the existing cloud-down fallback, but with the trigger broadened to unconditional (regardless of login state).

The code lives in the internal git.lswf.net symmetry-mobile repo. Same branch as #1162: release-3.6.1-local-setup-remote-access.

Goal

Any path into setup — actively adding a device, hitting an unconfigured router while logged in, or a fresh install that is not logged in — should skip the cloud steps and complete setup locally, with no cloud account association. The existing genuine-no-internet fallback behavior stays unchanged.

Task breakdown

• Add a localSetupOnly context flag (setupMachine.js)
• setLocalSetupOnly action sets it unconditionally to true, wired into the directSetupFlow entry (the common choke point for all ~10 setup entries, so it's fully covered)
• Guard refactor: the "skip cloud" branch guards now honor localSetupOnly (the main gate getInternetConnectionStatus + the set-password precondition, etc.); genuine-no-internet guards are left unchanged
• Full setup verification with a real router: run a complete setup against an unconfigured router and confirm no cloud login / account creation / provisioning appears at any point

Current status

Frontend code is done, committed, and pushed to origin (branch release-3.6.1-local-setup-remote-access, 2 commits). Verified:

• ✅ grunt build passes
• ✅ On-device test (Pixel 8, not logged in): entering directSetupFlow sets localSetupOnly to true automatically → the main gate routes to the local branch; genuine-no-internet guards unaffected

Pending confirmation

• Trigger condition (BLOCKING): Jimmy says it should be driven by the cloud SKU/model list, not unconditional. The current code is unconditional and will need to change to whitelist-driven — only the setLocalSetupOnly action + its check need updating. Awaiting Jimmy's confirmation of whether whitelisted models still go through cloud provisioning at setup (this settles the direction).
• Locally-set-up devices: can they register with the cloud later, or are they permanently local? (affects the flag's lifecycle)