feat(setup): center onboarding and add secure token help

docs/PORTAINER.md

@@ -8,11 +8,11 @@ through administrator and app setup. Users do not need a Dockerfile, source
 checkout, Python installation, `.env` file or another database container.
 
 **Release availability:** the image with zero-input managed bootstrap and
-wizard-configured origins still needs publishing to Docker Hub. These repository
-changes have not published an image or changed a live deployment. Until the
-release owner updates `latest` with this release, the template may pull an older
-image that lacks these features. `latest` is mutable, not an immutable release
-identifier; record the deployed digest and review release notes before updating.
+wizard-configured origins is published on Docker Hub. `latest` is mutable, not
+an immutable release identifier; record the deployed digest and review release
+notes before updating. If an existing stack still uses an older image, updating
+the Compose text alone does not pull the new image: explicitly re-pull it when
+redeploying, while retaining the same persistent volume.
 
 ## Requirements
 
@@ -49,6 +49,10 @@ identifier; record the deployed digest and review release notes before updating.
    private: anyone with that token and access to an unclaimed installation can
    create its first administrator. The command refuses to reveal it once an
    administrator exists.
+   The setup page's **Get setup token** button also shows these instructions and
+   offers **Copy command**. On browsers without clipboard access, select and
+   copy the displayed command manually. This help dialog does not generate or
+   reveal a token over the public web interface.
 5. Open Magent at the browser address you intend to use, such as
    `http://192.168.1.50:3000` on a trusted LAN or `https://magent.example.com`
    through your configured HTTPS proxy. Use the **Docker host's reachable

docs/PUBLIC_RELEASE.md

@@ -31,10 +31,10 @@ token-authorized first-administrator wizard; matching CORS and cookie security
 follow the saved URL automatically. Managed SQLite stays at
 `/app/data/magent.db`, and API documentation stays disabled.
 
-**Publication is still pending:** the new image must be published before the
-`latest` stack can supply this behaviour. Repository changes do not publish or
-deploy an image; an older `latest` image remains incompatible with this new
-workflow. `latest` is mutable, so record the resolved digest before an upgrade.
+The managed-install image is published on Docker Hub. Repository changes alone
+do not update an existing deployment: explicitly pull the image when upgrading,
+retaining the same persistent volume. `latest` is mutable, so record the resolved
+digest before an upgrade; older cached images may lack this setup workflow.
 The Compose runtime-security block stays enabled and must be left unchanged.
 See the [complete environment reference](ENVIRONMENT.md) for all supported
 variables and the difference between managed, manual and tooling controls.