First-run setup: ship no credentials, ask for them on first start

The exe shipped config/app_config.json AND src/player_auth.json inside the
bundle, and because a frozen app runs with cwd = _internal/, the player loaded
that snapshot as its live auth state. A stale snapshot therefore made a fresh
build boot "already authenticated" against an old server and play an outdated
playlist. It also meant every install inherited the build machine's server_ip,
screen_name and auth_code.

Both files are now excluded from the bundle (app_config.json is no longer added
to datas, player_auth.json is excluded from Tree(src)), and the runtime hook no
longer copies a config into place on first run.

New behaviour, all in src/main.py so it applies to the Pi build too:

  - The player starts with blank credentials. A missing file, an empty or
    unparseable file, missing keys, and leftover placeholder values
    (localhost, 127.0.0.1, kivy-player, 1234567) all count as UNCONFIGURED.
    config_is_configured() is the single source of truth for that decision.
  - After the splash video a notice appears ("Player is not configured"), and
    after 5 seconds the Settings screen opens automatically so the operator can
    enter the server details.
  - Saving valid values writes config/app_config.json next to the .exe and
    starts playback immediately - no restart needed.
  - On a machine that IS configured, the notice and Settings are skipped and the
    cached playlist plays straight away.
  - Settings refuses to close while the three required fields are blank, so it
    cannot be dismissed into a permanently blank screen with no way back.
  - The 30s playlist timer does not fight the setup flow while unconfigured.

on_intro_finished() is the single decision point after the splash; both intro
paths (video end and "no intro file") go through it so they cannot drift apart.

Also loads config over DEFAULT_CONFIG rather than replacing it, so a partial or
older config file keeps working defaults instead of losing keys.

Note for future changes: when adding a new REQUIRED config key, add it to
CONFIG_REQUIRED_KEYS or the first-run flow will not ask for it.

Verified on the packaged exe by removing the config to simulate a fresh install:
setup_required_shown -> setup_opening_settings exactly 5s later ->
setup_completed, with the config written next to the exe and playback resuming.
Restarting with that config produced no setup events at all.
Covered by windows/test_first_run_setup.py.

src/signage_player.kv

@@ -386,6 +386,7 @@
                         size_hint_x: 0.7
                         multiline: False
                         font_size: sp(13)
+                        hint_text: 'e.g. 192.168.0.110'
                         write_tab: False
                         on_touch_down: root.on_input_touch(self, args[1]) if self.collide_point(*args[1].pos) else None
                 
@@ -432,6 +433,7 @@
                         size_hint_x: 0.7
                         multiline: False
                         font_size: sp(13)
+                        hint_text: 'player name registered on the server'
                         write_tab: False
                         on_touch_down: root.on_input_touch(self, args[1]) if self.collide_point(*args[1].pos) else None
                 
@@ -454,6 +456,7 @@
                         size_hint_x: 0.7
                         multiline: False
                         font_size: sp(13)
+                        hint_text: 'e.g. 8887779'
                         write_tab: False
                         on_touch_down: root.on_input_touch(self, args[1]) if self.collide_point(*args[1].pos) else None