Fix SetupGuard error handling and add retry UI

frontend/src/components/__tests__/SetupGuard.test.tsx

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, waitFor } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { MemoryRouter, Routes, Route } from "react-router-dom";
 import { FluentProvider, webLightTheme } from "@fluentui/react-components";
 import { SetupGuard } from "../SetupGuard";
@@ -65,13 +65,32 @@ describe("SetupGuard", () => {
     expect(screen.queryByTestId("protected-content")).not.toBeInTheDocument();
   });
 
-  it("redirects to /setup when the API call fails", async () => {
-    // Task 0.3: a failed check must redirect to /setup, not allow through.
+  it("renders an error card when the setup status check fails", async () => {
     mockedGetSetupStatus.mockRejectedValue(new Error("Network error"));
     renderGuard();
+
     await waitFor(() => {
-      expect(screen.getByTestId("setup-page")).toBeInTheDocument();
+      expect(screen.getByRole("button", { name: /retry/i })).toBeInTheDocument();
     });
+    expect(screen.getByText(/network error/i)).toBeInTheDocument();
     expect(screen.queryByTestId("protected-content")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("setup-page")).not.toBeInTheDocument();
+  });
+
+  it("retries setup status fetch when Retry is clicked", async () => {
+    mockedGetSetupStatus.mockRejectedValueOnce(new Error("Network error"));
+    mockedGetSetupStatus.mockResolvedValueOnce({ completed: true });
+
+    renderGuard();
+
+    await waitFor(() => {
+      expect(screen.getByRole("button", { name: /retry/i })).toBeInTheDocument();
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: /retry/i }));
+
+    await waitFor(() => {
+      expect(screen.getByTestId("protected-content")).toBeInTheDocument();
+    });
   });
 });