ci(docs): fix screenshot capture against the #1335 C2 install guard

[rumblefrog]

Summary

The docs-screenshots-capture.yml workflow has been silently failing
to refresh installer screenshots (and panel-01-login) since the
screenshot pipeline first landed (#1333). The last run on PR #1426
(run 26143228051)
made the failure visible:

[capture] FAILED .../install/?step=1: locator('form') timeout
[capture] FAILED .../install/?step=2: locator('form') timeout
[capture] FAILED .../install/?step=5: locator('form') timeout
[capture] FAILED .../index.php?p=login: net::ERR_ABORTED

Two distinct root causes, both fixed here:

1. Install routes blocked by the Post-#1332 install-wizard human-flow audit: panel-takeover paths via localhost host-check bypass + /install/ replayable on installed panels, plus 8 UX gaps #1335 C2 guard. The wizard
   refuses to start over an installed panel: when web/config.php
   exists it short-circuits every /install/?step=N URL to a static
   409 "already installed" page with no <form>. The dev stack's
   docker/php/web-entrypoint.sh always creates config.php on
   first boot, so the waitFor: 'form' selector reliably times out.
2. panel-01-login aborted by post-login redirect.
   page.login.php emits <script>window.location.href='index.php'</script>
   whenever a session already exists. The single capture pass logged
   in first and then visited /index.php?p=login, where the inline
   redirect aborted Playwright's page.goto() with net::ERR_ABORTED.

Changes

• docs/scripts/capture.mjs accepts a new CAPTURE_ROUTES env var
  (all / panel / install, default all). The login route
  moves into PANEL_PUBLIC_ROUTES and is captured from a fresh,
  cookie-less browser context BEFORE the authenticated panel pass.
• .github/workflows/docs-screenshots-capture.yml runs the capture
  in two passes: panel first, then host-side stash of
  web/config.php → /tmp (the bind-mount means the container
  sees the rename), then install routes, then if: always() restore
  so a failed install pass still leaves the panel in a bootable
  state for docker compose down.
• docs/README.md documents the new env var and the manual
  stash/restore for local-dev install captures.

Step 5 of the wizard (admin form) still redirects to step 2 on a
cold deep-link because steps 3-6 are POST-handoff-gated; the
existing TODO note in capture.mjs covers that follow-up — out of
scope here.

Test plan

• Workflow YAML parses cleanly (verified locally via
  python3 -c "import yaml; yaml.safe_load(open(...))").
• node --check docs/scripts/capture.mjs passes locally.
• A maintainer applies the safe-to-screenshot label on a PR
  that touches the install wizard / panel chrome and confirms
  that docs-screenshots-capture.yml produces non-stale PNGs
  for both docs/src/assets/auto/install/*.png and
  docs/src/assets/auto/panel/*.png (including panel-01-login).
• Local repro: cd docs && npm run capture produces the panel
  set with web/config.php in place, and rerunning with the
  docs/README.md-documented stash dance fills in the install
  set.