Onboarding

Current bootstrap and invite-entry behavior for new users.

• Trigger:
• Google OAuth callback at `/api/auth/google/callback`
• runs only for a brand-new user when there is no invite code in OAuth `state`
• Backend builder:
• `OrganizationBuilder.createDefaultOrganization()`
• creates `My Organization`
• seeds `available_tokens` with `DEFAULT_AVAILABLE_TOKENS` (`2000`)
• sets the new org as the user's `current_organization_id`

• Builder reads system setting `onboarding_employee_id`.
• If the setting points to a valid system AI teammate, that teammate is cloned into the new org.

• The builder resolves the new user's personal Ally employee in the new org with `AiEmployeeService.findUserAllyEmployee(organizationId, user.id)`.
• If that personal Ally employee exists, the backend:
• creates or restores the user's employee-chat-backed Ally conversation for the new org
• inserts a completed AI welcome message
• updates the conversation last-message summary so it appears immediately in history
• The current seeded welcome starts with `Welcome — I’m Ally.`.

• `getOnboardingRedirectUrl(organizationId)` currently returns:
• `/staff?onboarding=true`
• The current onboarding redirect no longer targets a first-AI-teammate detail route.
• If organization ID is missing, the fallback is `/`.

• `ViewModeManager` watches `?onboarding=true`.
• After scoped internal-chat state is restored for the current `userId + organizationId`, it auto-opens Ally if Ally is not already visible.
• The onboarding open path forces Ally into a floating window near the bottom-right corner:
• margin: `20px`
• width: `MIN_WINDOW_SIZE.width`
• height: `60%` of viewport height
• On mobile, floating chat is converted back into the docked panel.

• Page bootstrap:
• loads invite metadata from `GET /api/invites/{code}`
• shows one of:
• guest invite view
• authenticated accept view
• already-in-organization view
• not-found state
• Guest behavior:
• `Sign in with Google` starts OAuth with `state: { inviteCode: code }`
• the guest view warns that sign-in will automatically accept the invite
• OAuth callback behavior with an invite code:
• backend tries `AcceptInviteProcessor` immediately
• on success, callback returns redirect `/`
• on handled invite failure, callback redirects back to `/invite/{code}`
• Authenticated behavior on the invite page:
• `Accept Invite` calls `GET /api/invites/{code}/accept`
• accepted invites redirect to `/`
• `already_in_organization` shows `Go to Dashboard`

• Landing on `/` after self-serve signup usually means the onboarding redirect did not receive an organization ID.
• Missing Ally welcome usually means the user's personal Ally employee was not created or could not be resolved in the new org.
• If `?onboarding=true` is present and Ally does not auto-open after load, treat that as unexpected.
• Invite acceptance always switches the user's current organization to the invited org.