frontend: add Create-profile setup screen for brand-new accounts

LoginGate now shows CreateProfile (display name only) instead of App when
an authenticated session has no provisioned geniusrun profile yet, backed
by the new POST /api/setup endpoint and session/me's has_profile flag.

frontend/src/LoginGate.tsx

@@ -2,6 +2,7 @@ import { useEffect, useState } from "react";
 import { api, BASE_URL } from "./api/client";
 import "./LoginGate.css";
 import App from "./App";
+import { CreateProfile } from "./CreateProfile";
 import type { SessionInfo } from "./types/api";
 
 type Status = "loading" | "authenticated" | "unauthenticated";
@@ -13,8 +14,10 @@ const AUTH_ERROR_MESSAGES: Record<string, string> = {
 
 // Wraps App: on mount, asks the backend whether this browser already has a
 // valid session (GET /api/session/me). geniusrun has no anonymous view, so
-// this is the only fork in the whole frontend between "show the login
-// screen" and "show the app."
+// this is the first fork -- "show the login screen" vs "show the app." A
+// second fork, once authenticated, is whether the session's account has a
+// provisioned profile yet (session.has_profile) -- a brand-new OIDC login
+// sees CreateProfile instead of App until it submits one.
 export function LoginGate() {
   const [status, setStatus] = useState<Status>("loading");
   const [session, setSession] = useState<SessionInfo | null>(null);
@@ -46,5 +49,13 @@ export function LoginGate() {
     );
   }
 
+  if (!session!.has_profile) {
+    return (
+      <CreateProfile
+        onCreated={(displayName) => setSession((s) => (s ? { ...s, has_profile: true, display_name: displayName } : s))}
+      />
+    );
+  }
+
   return <App session={session!} />;
 }