fix(onboarding): provisioned-guard refusal reads as operator guidance

'Re-keying requires the authenticated system.factory-reset' is precise and
useless to an operator standing at the seed screen. Map it to what they can
do: sign in, or factory-reset from Settings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/src/views/OnboardingSeedGenerate.vue

@@ -274,7 +274,14 @@ async function generateSeed() {
       stopTimers()
       loading.value = false
       waitingForServer.value = false
-      errorMessage.value = err instanceof Error ? err.message : 'Failed to generate seed'
+      const raw = err instanceof Error ? err.message : 'Failed to generate seed'
+      // The backend's provisioned-guard refusal is precise but written for
+      // developers ("authenticated system.factory-reset"). Operators hit it
+      // when a node that already has an identity lands on this screen —
+      // translate it into what they can actually do about it.
+      errorMessage.value = raw.startsWith('Not supported: this node is already provisioned')
+        ? 'This node already has an identity, so a new seed cannot be created. Sign in normally — or to start this node over, run a factory reset from Settings first.'
+        : raw
     }
   }
 }