fix: address final review blockers

- Add /api/onboarding and /status to PUBLIC_PATHS in hooks.server.ts
  so onboarding wizard and status page work for unauthenticated users
- Add isOnboardingNeeded() guard to POST /api/onboarding to reject
  calls after onboarding is complete (security hardening)
- Add data-app-widget attribute to all AppWidget card variants to
  enable j/k keyboard navigation

src/routes/api/onboarding/+server.ts

@@ -48,6 +48,12 @@ export const POST: RequestHandler = async ({ request }) => {
 	const { step, data } = parsed.data;
 
 	try {
+		// Guard: reject calls after onboarding is complete
+		const needed = await onboardingService.isOnboardingNeeded();
+		if (!needed) {
+			return json(error('Onboarding is already complete'), { status: 403 });
+		}
+
 		switch (step) {
 			case 'admin': {
 				// Create admin user