Walk docs/setup.md end to end on a fresh account

Follow docs/setup.md word for word on a Cloudflare account and host that have never seen keystone: install, deploy, the 404 check, keyset new, keyset deploy --new, clevis luks bind, initramfs, reboot unlock, then rotate and revoke. Fix any step that fails as written.

Every step has run somewhere, but never as one sequence from the page. The Debian/Ubuntu initramfs-tools snippet has never been run.