Hide excluded sandbox providers during setup

[mrubens]

Summary

• hide explicitly excluded sandbox providers from the onboarding provider picker
• reject excluded provider choices and configuration submissions on the server
• validate provider availability before provisioning locks or cleanup side effects
• add client and server regression coverage

Root cause

The setup status correctly exposed deployment exclusions, but onboarding rendered the full provider catalog and its save handlers only checked catalog membership. That allowed an excluded provider to remain visible and accept submissions even though runtime provider resolution would ignore it.

Impact

Hosted deployments can exclude unsupported local compute options without those options appearing during onboarding. Unconfigured hosted providers remain selectable as before.

Validation

• focused onboarding client tests
• focused setup command server tests
• pnpm --filter @roomote/web check-types
• targeted ESLint and Prettier checks
• pre-push lint:fast, check-types:fast, and knip

[roomote-roomote]

No code issues found. See task

• apps/web/src/app/(onboarding)/setup/hooks.ts:390-421: A provider selected before deployment exclusions change is still treated as selected through setupNewState.computeProvider. The flow skips the provider picker (and can skip config when the old provider remains configured), then starts onboarding even though buildSetupComputeStatus has filtered that provider out. Use the filtered computeSetup.selectedProvider when deciding the compute steps, and reject/reselect a stale excluded choice before launch.

_{Reviewed 309f476}