feat(help): public /help setup-and-troubleshooting page

Anchor for the manual QR baked into the firmware Step 1/2 screen
(pictureframe-firmware e089911). One self-contained Twig page,
PUBLIC_ACCESS in security.yaml, /help excluded from the SPA catch-all
regex so it doesn't get swallowed.

Scope is deliberately tight: first-time setup screen by screen, the
captive-portal-didn't-open fallback (manual nav to 192.168.4.1 plus
the iOS lock-screen-scan caveat), the connection-failed retry path,
how to wipe the frame for a new account, photo-not-appearing
diagnosis, and what the yellow/red status borders mean. Anything
beyond that goes in the SPA proper, not here.

No frontend rebuild needed — pure server-rendered Twig + inline CSS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Controller/HelpController.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+#[IsGranted('PUBLIC_ACCESS')]
+class HelpController extends AbstractController
+{
+    #[Route('/help', name: 'help', methods: ['GET'])]
+    public function index(): Response
+    {
+        return $this->render('help/index.html.twig');
+    }
+}

src/Controller/SpaController.php

@@ -24,7 +24,7 @@ class SpaController extends AbstractController
     #[Route(
         '/{path}',
         name: 'spa',
-        requirements: ['path' => '^(?!api|setup|token|login|register|logout|_profiler|_wdt).*'],
+        requirements: ['path' => '^(?!api|setup|token|help|login|register|logout|_profiler|_wdt).*'],
         defaults: ['path' => ''],
     )]
     public function index(): Response