feat(setup): center onboarding and add secure token help

docs/PORTAINER.md

@@ -8,11 +8,11 @@ through administrator and app setup. Users do not need a Dockerfile, source
 checkout, Python installation, `.env` file or another database container.
 
 **Release availability:** the image with zero-input managed bootstrap and
-wizard-configured origins still needs publishing to Docker Hub. These repository
-changes have not published an image or changed a live deployment. Until the
-release owner updates `latest` with this release, the template may pull an older
-image that lacks these features. `latest` is mutable, not an immutable release
-identifier; record the deployed digest and review release notes before updating.
+wizard-configured origins is published on Docker Hub. `latest` is mutable, not
+an immutable release identifier; record the deployed digest and review release
+notes before updating. If an existing stack still uses an older image, updating
+the Compose text alone does not pull the new image: explicitly re-pull it when
+redeploying, while retaining the same persistent volume.
 
 ## Requirements
 
@@ -49,6 +49,10 @@ identifier; record the deployed digest and review release notes before updating.
    private: anyone with that token and access to an unclaimed installation can
    create its first administrator. The command refuses to reveal it once an
    administrator exists.
+   The setup page's **Get setup token** button also shows these instructions and
+   offers **Copy command**. On browsers without clipboard access, select and
+   copy the displayed command manually. This help dialog does not generate or
+   reveal a token over the public web interface.
 5. Open Magent at the browser address you intend to use, such as
    `http://192.168.1.50:3000` on a trusted LAN or `https://magent.example.com`
    through your configured HTTPS proxy. Use the **Docker host's reachable