docs(3167): the setup guide gains a swarm UI step, and one group name

Per mara on the PR: the guide someone follows on a fresh deploy is a
different page from the one they read while debugging, and only the
second existed.

Also fixes a contradiction the request surfaced: setup.md and
swarm/sso.md have told every operator to create '--group admins' since
the bootstrap step existed, while the new rule required 'operators'.
This is the first rule that CONSUMES a group name, so it takes the one
the guide already creates - inventing a second would have meant every
account made by following the guide silently failing the check it was
supposed to pass, and for mara specifically a migration step that now
may not be needed at all.

setup.md's step 3 says why --group is not decoration; the new step 4
says what decides whether the page opens (the group, and the name
resolving) rather than listing a command, because there is nothing to
run. Steps renumbered, including the matrix block's internal 4a-4e.

docs/swarm/README.md

@@ -97,7 +97,7 @@ another container, and the three ways that one gets delivered:
 ## Swarm UI
 
 The operator-only web surface on the swarm apex, why reaching it needs
-the `operators` group rather than just a session, and the four sites a
+the `admins` group rather than just a session, and the four sites a
 swarm service name has to be wired into: [`ui.md`](ui.md).
 
 ## The swarm's hive directory