docs(3167): the setup guide gains a swarm UI step, and one group name

Per mara on the PR: the guide someone follows on a fresh deploy is a
different page from the one they read while debugging, and only the
second existed.

Also fixes a contradiction the request surfaced: setup.md and
swarm/sso.md have told every operator to create '--group admins' since
the bootstrap step existed, while the new rule required 'operators'.
This is the first rule that CONSUMES a group name, so it takes the one
the guide already creates - inventing a second would have meant every
account made by following the guide silently failing the check it was
supposed to pass, and for mara specifically a migration step that now
may not be needed at all.

setup.md's step 3 says why --group is not decoration; the new step 4
says what decides whether the page opens (the group, and the name
resolving) rather than listing a command, because there is nothing to
run. Steps renumbered, including the matrix block's internal 4a-4e.

nix/host-modules/swarm-authelia.nix

@@ -43,7 +43,14 @@ let
   # here because this module writes the rule that enforces it and
   # `swarmctl user add --group <this>` is what grants it — the two must
   # agree, and one constant is how they stay agreeing.
-  operatorGroup = "operators";
+  #
+  # ⚠️ `admins` and not a new word, because `docs/setup.md` and
+  # `docs/swarm/sso.md` have been telling every operator to create
+  # exactly that group since the bootstrap step existed. This is the
+  # first rule that CONSUMES a group name; picking a different one would
+  # have meant every account created by following the guide silently
+  # failing the check it was supposed to pass.
+  operatorGroup = "admins";
 
   # Upstream's `services.authelia.instances.<name>` derives the unit,
   # user, group and StateDirectory from the instance name