feat(setup): center onboarding and add secure token help

README.md

@@ -10,10 +10,9 @@ Paste [compose.yml](compose.yml) into a Portainer **Docker Standalone** stack.
 It uses `rephl3xnz/magent:latest`, persists data in a named volume and needs no
 environment variables or Dockerfile on the user's machine.
 
-**Image availability:** this source snapshot has not yet been published to
-Docker Hub. The current `latest` image may not include this setup flow. Until a
-compatible image is published, use the source-build command below for testing.
-Only Linux/amd64 has been validated.
+**Image availability:** the managed-install image is published on Docker Hub.
+Only Linux/amd64 has been validated. `latest` is mutable; record the resolved
+image digest before updating, or pin an immutable release tag.
 
 1. Deploy the stack and wait for the container to become healthy.
 2. In its console, select `/bin/ash` and user `magent`, then run:
@@ -24,6 +23,8 @@ Only Linux/amd64 has been validated.
 
 3. Open the Docker host's address on port 3000. Confirm the browser-facing URL
    in setup and use the token to create the first administrator.
+   The **Get setup token** button shows the console instructions and lets you
+   copy the command; it never reveals the token to public visitors.
 4. Connect your apps, choose preferences and finish setup. Optional apps can
    be skipped. Save an encrypted backup afterwards.