docs(web): "Migration Process at a Glance" no longer SSH-only

The landing-tab overview still framed SSH as a hard prerequisite —
"Migration requires SSH access." That was true under the original
design, but the wizard now probes both SSH and Telnet:17000
automatically and uses whichever the device exposes. SSH-less
speakers (USB-unlock-refusing firmware like SA-5, ST520, recent ST
Portables) can migrate over telnet without ever opening a shell.

Updates:

  - Prerequisite box retitled "Speaker shell access" with two
    sub-bullets that match the state card's Transports row:
      * SSH — richest option, required for XML / DNS / CA install,
        same USB-stick procedure as before
      * Telnet:17000 — SSH-less fallback, no setup, HTTP-only
  - Step 1 (Settings) now mentions that Target URL can be edited
    inline on the Migration tab with Save as default, since the
    Settings tab is no longer the only place to set it.
  - Step 4 (Migration) replaces "we recommend the XML Configuration
    method" with a description of the actual wizard: Apply
    Suggested Plan, Customize three-axis form, and the visible
    pre-flight check.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pkg/service/handlers/web/index.html

@@ -53,34 +53,36 @@
 
         <h3>Migration Process at a Glance</h3>
         <div class="info-box prerequisite-box">
-            <strong>🔌 Prerequisite: Enable SSH</strong><br/>
-            Migration requires SSH access. To enable it:
-            <ol style="margin-top: 5px; margin-bottom: 5px">
-                <li>
-                    Create an empty file named
-                    <code>remote_services</code> on a USB stick.
-                </li>
-                <li>
-                    Insert it into the speaker's
-                    <strong>SERVICE</strong> port and reboot the
-                    speaker.
-                </li>
-            </ol>
-            <strong>Verify connection:</strong>
+            <strong>🔌 Speaker shell access</strong><br/>
+            The wizard talks to the speaker over one of two transports.
+            The <strong>Migration</strong> tab probes both automatically
+            and uses whichever your device exposes — you don't have to
+            choose manually.
             <ul style="margin-top: 5px; margin-bottom: 0; padding-left: 20px;">
                 <li>
-                    Use the <strong>Migration</strong> tab to select
-                    your device and verify that
-                    <em>SSH Connection</em> shows ✅ Success.
-                </li>
-                <li>
-                    Or manually:
+                    <strong>SSH</strong> (richest option — required for
+                    the XML migration, the <code>/etc/resolv.conf</code>
+                    DNS hook, and installing the local CA). Enable it by
+                    creating an empty <code>remote_services</code> file
+                    on a USB stick, inserting it into the speaker's
+                    <strong>SERVICE</strong> port, and rebooting. Verify
+                    on the Migration tab — <em>SSH</em> in the state
+                    card's <em>Transports</em> row should show ✅
+                    Reachable. Manual check:
                     <code
                     >ssh -oHostKeyAlgorithms=+ssh-rsa
                         root@&lt;SPEAKER-IP&gt;</code
                     >
                     (no password).
                 </li>
+                <li>
+                    <strong>Telnet (Port 17000)</strong> — the SSH-less
+                    fallback. Most SoundTouch firmware exposes a
+                    diagnostic shell on TCP/17000 automatically, no
+                    USB-stick setup required. Limited to HTTP migrations
+                    (no CA install possible without SSH). The state card
+                    surfaces this in the same <em>Transports</em> row.
+                </li>
             </ul>
         </div>
         <ol class="guide-steps">
@@ -90,7 +92,9 @@
                 Domain" and "Proxy Domain" use an IP address or domain
                 name that is
                 <strong>accessible from your speakers</strong> (usually
-                the IP of this server on your local network).
+                the IP of this server on your local network). You can
+                also edit the Target URL directly from the Migration tab
+                with a <em>Save as default</em> button.
             </li>
             <li>
                 <strong>Discovery:</strong> Go to the
@@ -107,10 +111,15 @@
             </li>
             <li>
                 <strong>Migration:</strong> In the
-                <strong>Migration</strong> tab, redirect your speaker to
-                this local service. We recommend the
-                <strong>XML Configuration</strong> method as it is
-                surgical and easily reversible.
+                <strong>Migration</strong> tab the wizard offers a
+                one-click <strong>Apply Suggested Plan</strong> that
+                picks the right recipe for your speaker (XML over SSH
+                when SSH is available, telnet URL flip otherwise). For
+                mix-and-match across the three independent axes — URL
+                flip transport, DNS interception, CA install — expand
+                <em>Customize this migration</em>. A visible pre-flight
+                check runs before any backend operation touches the
+                speaker.
             </li>
             <li>
                 <strong>Verification:</strong> After migration and