Rename setups and add provider reauthentication

AGENTS.md

@@ -34,7 +34,7 @@ Module-by-module intent is in PLAN.md's "Backend layout".
 
 - `server/` — the Rust backend (`ai-server`). `routes.rs`'s module doc
   comment is the HTTP table and the surface's source of truth.
-  **A llama.cpp session runs on whatever machine its setup names** (built
+  **A llama.cpp session runs on its configured machine** (built
   2026-09-04, the last of phase 5): `Transport::reserve_port` returns the
   port the server binds *there* and the port that reaches it *here*, and
   `Launch::reaching` puts the `-L` tunnel on the connection already carrying
@@ -43,7 +43,7 @@ Module-by-module intent is in PLAN.md's "Backend layout".
   because `llama-server` never reads the stdin whose closing ends a CLI and
   the same kill left it loaded on the far machine; the model is looked for on
   the machine that will serve it, so the spawn screen offers
-  `GET /setups/{id}/models` rather than the backend's own downloads; and the
+  `GET /machines/{id}/models` rather than the backend's own downloads; and the
   readiness poll watches the process as well as the port, since a model that
   will not load exits in a second and was being reported as "gave up after
   300s". See PLAN.md's "Transport" and "llama-server management".
@@ -53,7 +53,7 @@ Module-by-module intent is in PLAN.md's "Backend layout".
   protocol.
 - `app/` — the Compose app, package `com.example.aiapp`, label "AI Sessions".
   `AppRoot.kt` is the navigation `when`; `MainScreen.kt` the root's four tabs
-  (sessions, import, models, setups); `Api.kt`/`EventStream.kt` the REST + SSE
+  (sessions, import, models, machines); `Api.kt`/`EventStream.kt` the REST + SSE
   clients; `Events.kt` the event model mirror; `ServerConfig.kt` settings and
   the Keystore-sealed token.
 - `wg-app-link/` — a **git submodule** shared with dev-updater: the pinned CA
@@ -64,7 +64,7 @@ Module-by-module intent is in PLAN.md's "Backend layout".
   build without it, since it is a path dependency, which is what keeps the two
   projects version-locked to the commit this repo pins. What deliberately did
   **not** move is the API surface and the config *schema*: routes, drivers,
-  sessions and setups are what makes this project itself.
+  sessions and machines are what makes this project itself.
 - `SUBAGENTS.md` — a session's subagents as transcripts of their own
   (`server/src/session/subagent.rs`, the subcards in `SessionListScreen.kt`
   and the read-only form of `SessionScreen.kt`); `DECISIONS.md` holds the
@@ -175,7 +175,7 @@ means here:
 
 - **`ai-server` belongs on the host in production.** That is where the LAN
   address the phone can reach is, and where WireGuard terminates.
-  `wg-setup-host.sh` sets that up (keys, `wg0.conf`, the phone's QR); run it
+  `wg-machine-host.sh` sets that up (keys, `wg0.conf`, the phone's QR); run it
   there with `sudo WG_ENDPOINT=<ddns name>`.
 - **The tunnel and the real phone can never terminate in the VM**, because
   nothing outside can open a connection into it. Phone bring-up is host work.