a real form, and the URL step no longer demands a token

Two things reported from a production instance.

The URL step was refused with "an access token is required the first time" — a
check that predates splitting the screen into two steps, and which made the
first step impossible to complete. Naming the instance is now its own step; a
member still needs a token, since setting one is all they do.

And the fields were a div, so pressing Enter did nothing and the button was the
only way to submit. That is a keyboard trap wearing a layout. Now a <form> with
onSubmit, with the other two buttons marked type="button" so they do not submit
it.

19 panel files across the platform have the same problem. Recorded in the
platform's TODO.md rather than swept blindly — a search box has no submit, and
a multi-field editor wants the useForm hook.

Also dropped the hint under the URL field, which repeated the sentence directly
above it.

sidecar/index.ts

@@ -198,7 +198,14 @@ async function handleConfig(req: Request, userId: number): Promise<Response> {
     }
 
     const existing = await getServiceConnection(userId, 'gitea');
-    if (!token && !existing?.hasSecret) return bad('an access token is required the first time');
+    // NOT required on the first save any more. Naming the instance is its own step — the owner says
+    // where Gitea is, and the token is asked for (or found in tea's config) afterwards. This check
+    // predates that split and refused the URL step outright.
+    //
+    // A member is different: they set nothing but a token, so an empty save from them means nothing.
+    if (!owner && !token && !(await readTeaLogin(userId, base))?.hasToken) {
+      return bad('an access token is required');
+    }
 
     // Probe with the credentials as they WILL be, so a save either stores something that works or
     // fails with the reason. Storing first and discovering later makes every downstream screen fail