fix(docs): clear the quickstart drift the upstream fixes caused

The three defects phase 7 found are fixed and merged: website#163
(SECRET_ENC_KEY missing from the root .env.example, plus BOT_INTERNAL_KEY in
the README's "set at least" list) and installer#22 + docs#174 (the handoff
printing /admin/shard).

website#163 turned checkQuickstart red here, which is precisely what the
declaration was built to do -- it fails the moment a declared key appears
upstream, so the note describing the omission cannot outlive the defect. The
SECRET_ENC_KEY entry is deleted and notInUpstreamEnvExample is now empty; the
export stays so the next divergence gets an entry rather than passing quietly.

The stale-path Aside on Connect a game server is pinned to v0.1.0 rather than
calling the installer permanently wrong, and now says WHY the old path is worse
than a 404: the SPA has no route for it, so it redirects to the dashboard and
the link looks like it worked.

v0.1.0 is still the current download, and not only because releases lag. The
release run for installer#22 built every artifact and pushed tag v0.1.1, then
took a 500 creating the release -- so the tag is orphaned and no binaries were
published. Raised on installer; nothing is worked around here.

This also recovers 084ee0b, which was pushed to feat/phase-7-docs after PR #10
had already merged f499f2b, and so never reached main.

Co-Authored-By: Claude <noreply@anthropic.com>

PLAN.md

@@ -909,12 +909,19 @@ Hero editor into Branding and theming, Web Bot Activity into Authentication.
   it is **missing from website's root `.env.example`**, the file Compose actually reads. It is
   present in `server/.env.example`, which is the file local development copies, which is why this
   has never bitten anyone in dev. The quickstart carries it, declared as an upstream omission so the
-  check fails the day it is fixed.
+  check fails the day it is fixed. **Fixed in website#163** (merged 2026-08-24), which also adds
+  `BOT_INTERNAL_KEY` to the README's "set at least" list — required in production even on a
+  deployment running no bot. The declaration did exactly what it was built to do: this repo went red
+  on the next run, and the entry is deleted here.
 - **The installer points operators at a screen that no longer exists.** It prints
   `<site>/admin/shard`, and INSTALL.md §5 repeats it. Since the module-system cutover a module owns
-  one path segment, and the screen is **`/admin/uo/link`**, labelled *Shard (uo-link)*. Both the
-  binary (`installer` `main:src/sidecar.rs`) and the guide are stale; the journey documents the real
-  path and says the printed one does not resolve.
+  one path segment, and the screen is **`/admin/uo/link`**, labelled *Shard (uo-link)*. The old path
+  does not even 404 — the SPA sends the operator to the dashboard, so the link looks like it worked
+  and the four values have nowhere to go. **Fixed in installer#22** (the path is a named constant and
+  both handoff tests assert it) **and docs#174**, both merged 2026-08-24. The note here is pinned to
+  **v0.1.0** because that is still the current download: the release run for the fix built every
+  artifact and pushed tag `v0.1.1`, then took a `500` creating the release, leaving the tag orphaned
+  and no binaries published. That is an `installer` problem, not this repo's, and is raised there.
 - **The admin "Restart the server" button opens a `window.confirm`.** Its text is the honest
   warning that a deployment with no supervisor does not come back — which is exactly why
   `restart: unless-stopped` is called out as load-bearing on the install page rather than left as