[CORE-177] User Onboarding API Integration

[1457dys]

Type of changes

Feature

Purpose

• Limit access to /welcome to the intended first-login members, while still allowing smooth local development.
• Add a guard on WelcomePage (member + first login when available).
• Added a dev bypass: VITE_MUTE_WELCOME_GUARD=true.
• Prefill stays the same: nickname = user.name, username = user.username.
• Improved username input: trim spaces and validate as the user types.

Addition

TODO: switch to “fail-close” once the backend response contract is confirmed.