fix: setup wizard shows no error feedback on validation failure

The ToastContainer was only rendered inside the authenticated app shell,
making all toast notifications invisible during the first-run setup wizard.
Users clicking "Create Account" with an invalid password saw no feedback
at all — just silent 400 errors in the browser console.

- Move ToastContainer outside the needsAuth conditional so it renders
  unconditionally, including during setup
- Add client-side password length validation (>= 12 chars) in SecurityStep
  to catch the most common case before hitting the server
- Fix WelcomeStep to check response.ok after bootstrap token validation
  so the wizard won't advance with an invalid token

Related to #1173

frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx

@@ -44,18 +44,19 @@ export const WelcomeStep: Component<WelcomeStepProps> = (props) => {
 
         setIsValidating(true);
         try {
-            await apiFetch('/api/security/validate-bootstrap-token', {
+            const response = await apiFetch('/api/security/validate-bootstrap-token', {
                 method: 'POST',
                 body: JSON.stringify({ token: props.bootstrapToken.trim() }),
             });
 
+            if (!response.ok) {
+                throw new Error('Invalid bootstrap token');
+            }
+
             props.setIsUnlocked(true);
             showSuccess('Token verified!');
             props.onNext();
         } catch (_error) {
-            if (_error instanceof Error && _error.message !== 'Invalid bootstrap token') {
-                // In case apiFetch throws other errors
-            }
             showError('Invalid bootstrap token. Please check and try again.');
         } finally {
             setIsValidating(false);