proto(woo): blocking setup gate; require X-Woo-* on Woo HTTP routes

Full-screen WooSetupGate on App mount when this browser lacks device WP
user + app password. Save + Test Woo dismisses only after a successful
test. Publish/test-woo auth failures reopen the gate.

Server: client_for_request requires X-Woo-* on publish, taxonomy sync,
and test-woo (401 woo_device_creds_required); health probe keeps
Settings. Optional SLAB_WOO_ALLOW_SETTINGS_FALLBACK for legacy tests.

See PROTOTYPE.md.

frontend/src/api/wooDeviceCreds.ts

@@ -76,3 +76,9 @@ export function withWooHeaders(extra?: HeadersInit): HeadersInit {
   }
   return { ...extra, ...woo };
 }
+
+/** True when this browser has both device Woo username and app password. */
+export function hasDeviceWooCreds(): boolean {
+  const { username, appPassword } = getDeviceWooCreds();
+  return Boolean(username && appPassword);
+}