Visit Setup Step

Record the visit that closes a view-only step.

Idempotent — the target screen fires it on arrival, which happens again every time the user comes back, and the row is keyed on (project, step). Returns a JSON body on purpose: a bare 204 makes the frontend's apiClient throw (_dashboard/api.ts).