feat(gui): --first-run flag + firstrun::run stub for Phase 10

argv is read manually before adw::Application sees it (GTK's option parser
rejects unknown long flags), then the filtered list is passed to
app.run_with_args. Stub exits cleanly with a stderr breadcrumb so a
developer who passes --first-run before Phase 10 lands doesn't get a
stuck process.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gui/src/firstrun.rs

@@ -0,0 +1,14 @@
+//! First-login modal. Phase 10 implements the body of `run`.
+
+#![allow(dead_code)] // body lands in Phase 10.
+
+use crate::app_context::AppContext;
+
+/// Entry point for `authforge --first-run`. Phase 10 fills this with the
+/// fullscreen modal + watchdog + enroll-then-clear-pending logic.
+/// Until then it exits cleanly so a developer who passes `--first-run`
+/// doesn't get a stuck process.
+pub(crate) fn run(_ctx: AppContext) {
+    eprintln!("authforge: --first-run mode is a Phase 10 stub; exiting.");
+    std::process::exit(0);
+}