Make onboarding a wizard: transport choice, live test, member pickers

Onboarding is now three steps: connect, choose the update transport, then
choose which members to surface.

The transport step tests the chosen method before continuing, so problems
surface up front instead of silently later. The live stream connects and
waits for the snapshot; polling does a fetch; webhook does a reachability
precheck (a URL Sheaf can reach, plus the notification scopes, without
waiting on an async delivery). Hard failures (bad auth, missing scope,
stream disabled, no reachable URL) block with a clear message and nudge
toward a working transport; the webhook LAN case proceeds and is flagged at
runtime.

The member step populates include/exclude pickers from the system's actual
members and groups, with free text still allowed for anything not listed, and
falls back to text boxes if the lists can't be loaded. The options flow gains
the same pickers.

Author: SiteRelEnby

README.md

@@ -37,8 +37,16 @@ You need an API key. In the Sheaf web UI: *Settings > API Keys > Create*, with t
 
 API keys can't create other keys, so this must be done from the web UI. The key is shown once.
 
-When you add the integration, enter your instance URL (e.g. `https://app.sheaf.sh`) and the
-key.
+Adding the integration is a short wizard:
+
+1. **Connect** - enter your instance URL (e.g. `https://app.sheaf.sh`) and the key.
+2. **Transport** - pick how updates arrive (see below). Your choice is tested before you can
+   continue, so a disabled stream or an unreachable webhook is caught up front rather than
+   failing silently later.
+3. **Members** - optionally narrow which members are surfaced, picking from your actual member
+   and group lists.
+
+All of this can be changed afterwards from the integration's *Configure* button.
 
 ## Entities