feat(setup): say when the new owner still has to verify

extension/contract/handlers_auth_pages.go

@@ -273,6 +273,13 @@ type SetupEnvironmentInput struct {
 type SetupResponse struct {
 	OK      bool   `json:"ok"`
 	Subject string `json:"subject"`
+	// VerificationRequired is true while the new account's email is
+	// unverified. The account becomes platform-owner when that email is
+	// verified, not at sign-up: setup runs unauthenticated on a fresh
+	// install, so granting it here would hand the deployment to whoever
+	// reached setup first. A dashboard reads this to tell you why you
+	// can't administer anything yet.
+	VerificationRequired bool `json:"verification_required"`
 }
 
 func setupStatusHandler(deps Deps) func(ctx context.Context, _ struct{}, _ contract.Principal) (SetupStatusResponse, error) {
@@ -576,7 +583,7 @@ func setupHandler(deps Deps) func(ctx context.Context, in SetupInput, _ contract
 		if u != nil {
 			subject = u.ID.String()
 		}
-		return SetupResponse{OK: true, Subject: subject}, nil
+		return SetupResponse{OK: true, Subject: subject, VerificationRequired: u != nil && !u.EmailVerified}, nil
 	}
 }
 

extension/contract/handlers_auth_pages_test.go

@@ -248,6 +248,7 @@ func TestSetupHandlerAppliesPlatformEnvironmentAndOwner(t *testing.T) {
 	// Platform ownership is claimed on email verification (e0286f4c), so
 	// whoever reaches a fresh deployment first can't take it with an
 	// address they don't control. Setup doesn't get around that.
+	require.True(t, got.VerificationRequired, "setup must tell the caller the owner still has to verify")
 	require.False(t, holdsPlatformOwner(), "setup alone must not grant platform-owner")
 	secutil.VerifyEmail(t, eng, userID)
 	require.True(t, holdsPlatformOwner(), "the setup user becomes platform-owner once verified")