feat(cluster): FQDN-First Token-Flow — Node vor dem Join vorregistrieren

Cluster-Seite: Schritt 2 fragt jetzt den FQDN des neuen Knotens bevor
der Token generiert wird. Der Knoten wird sofort in ha_nodes (status=pending)
eingetragen. Nach Token-Generierung wird direkt die Setup-Wizard-URL des
neuen Knotens angezeigt (https://<fqdn>:3443/setup).

Backend: POST /cluster/join-tokens nimmt jetzt node_fqdn entgegen,
pre-registriert via preRegisterByFQDN(). Die IP wird beim issue-cert
nachgetragen (preRegisterJoiner).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/en/common.json

@@ -615,11 +615,11 @@
     "step1Title": "1 — Install EdgeGuard on the new host",
     "step1Desc": "Run as root on the new host (Debian 13, amd64):",
     "step2Title": "2 — Generate a join token here (on this primary node)",
-    "step2Desc": "Creates a one-time HMAC token valid for 30 minutes. The token authorises the new node to receive a signed cluster TLS certificate.",
+    "step2Desc": "Enter the FQDN of the new node first. This pre-registers it and opens port 8443 for the join.",
     "step3Title": "3 — Run on the new node",
     "step3NoToken": "Click \"Generate join token\" above — the full command will appear here.",
     "step4Title": "4 — Restart edgeguard-api on the new node",
-    "step4Desc": "The service loads the new cluster TLS certificate and starts sending heartbeats. The node appears in the Peers table within 30 seconds.",
+    "step4Desc": "After the setup wizard completes on the new node, restart edgeguard-api there to load the cluster certificates:",
     "apiUnreachable": "Cluster API not reachable",
     "tokenLabel": "Token",
     "caFingerprintLabel": "CA fingerprint",
@@ -670,7 +670,11 @@
       "joining": "joining",
       "leaving": "leaving",
       "unknown": "unknown"
-    }
+    },
+    "step3SetupDesc": "Open the setup wizard on the new node (https://<node-fqdn>:3443/setup), choose \"Join existing cluster\", enter the primary FQDN ({{primaryFqdn}}) and paste the token above.",
+    "generateNewToken": "Generate new token",
+    "setupWizardHint": "Open the setup wizard on the new node",
+    "newNodeFqdnLabel": "New node FQDN"
   },
   "ssl": {
     "title": "SSL certificates",