Tighten the setup flow after a review of the whole diff

The done screen moves focus to its heading like every other screen; the
confirm screen's preference list holds only dt/dd pairs and the settings
link stands beside it; Back from Q1 is not offered once the flow has
been entered, because the front door would resume past the welcome and
bounce straight back; the medication task records no target on the
ledger, as the contract says, and keeps the id on the screen; and the
two success affordances go through the outcome module rather than a
hand-rolled tick. The error-code catalogue lists the answers and restart
codes and no longer the retired step ones, and the session-surface guard
learns the one new deriving helper the onboarding pages read through.

src/lib/openapi/error-codes.ts

@@ -234,15 +234,13 @@ export const ERROR_CODE_CATALOGUE: Readonly<Record<string, readonly string[]>> =
       "nutrient.water.invalid_day",
     ],
     onboarding: [
+      "onboarding.answers.invalid",
+      "onboarding.answers.rateLimited",
       "onboarding.complete.invalid",
       "onboarding.disclaimer.invalid",
-      "onboarding.step.completed",
-      "onboarding.step.concurrent",
-      "onboarding.step.invalid",
-      "onboarding.step.outOfOrder",
-      "onboarding.step.rateLimited",
+      "onboarding.restart.invalid",
+      "onboarding.restart.rateLimited",
       "onboarding.tour.invalid",
-      "onboarding.user.notFound",
     ],
     personal_records: ["personal_records.invalid_query"],
     practitioner: ["practitioner.invalid"],