docs(journey): pin the stale-path note to v0.1.0, and record the fix PRs

The two upstream defects this phase found are now open as fixes — website#163
(SECRET_ENC_KEY missing from the root .env.example, plus the README's set-at-least
list) and installer#22 + docs#174 (the handoff printing /admin/shard).

So the note on Connect a game server is pinned to installer v0.1.0, which is what
operators download until the next release, rather than describing the installer as
permanently wrong. It also now says WHY the old path is worse than a 404: the SPA
sends you to the dashboard, so the link looks like it worked.

checkQuickstart still passes because website main has not moved yet. It fails by
design the moment website#163 merges, and the SECRET_ENC_KEY declaration in
src/data/quickstart.mjs is deleted in a one-line follow-up at that point.

Co-Authored-By: Claude <noreply@anthropic.com>

PLAN.md

@@ -909,12 +909,16 @@ Hero editor into Branding and theming, Web Bot Activity into Authentication.
   it is **missing from website's root `.env.example`**, the file Compose actually reads. It is
   present in `server/.env.example`, which is the file local development copies, which is why this
   has never bitten anyone in dev. The quickstart carries it, declared as an upstream omission so the
-  check fails the day it is fixed.
+  check fails the day it is fixed — **fixed in website#163**, which also adds `BOT_INTERNAL_KEY` to
+  the README's "set at least" list for the same reason. When that merges, `checkQuickstart` goes red
+  here by design and the declaration is deleted in a one-line follow-up.
 - **The installer points operators at a screen that no longer exists.** It prints
   `<site>/admin/shard`, and INSTALL.md §5 repeats it. Since the module-system cutover a module owns
-  one path segment, and the screen is **`/admin/uo/link`**, labelled *Shard (uo-link)*. Both the
-  binary (`installer` `main:src/sidecar.rs`) and the guide are stale; the journey documents the real
-  path and says the printed one does not resolve.
+  one path segment, and the screen is **`/admin/uo/link`**, labelled *Shard (uo-link)*. The old path
+  does not even 404 — the SPA sends the operator to the dashboard, so the link looks like it worked
+  and the four values have nowhere to go. **Fixed in installer#22** (the path is a named constant and
+  both handoff tests assert it) **and docs#174**; the journey names the real path and pins the note to
+  v0.1.0, which is what operators download until the next release.
 - **The admin "Restart the server" button opens a `window.confirm`.** Its text is the honest
   warning that a deployment with no supervisor does not come back — which is exactly why
   `restart: unless-stopped` is called out as load-bearing on the install page rather than left as