fix(docs): clear the quickstart drift the upstream fixes caused

The three defects phase 7 found are fixed and merged: website#163
(SECRET_ENC_KEY missing from the root .env.example, plus BOT_INTERNAL_KEY in
the README's "set at least" list) and installer#22 + docs#174 (the handoff
printing /admin/shard).

website#163 turned checkQuickstart red here, which is precisely what the
declaration was built to do -- it fails the moment a declared key appears
upstream, so the note describing the omission cannot outlive the defect. The
SECRET_ENC_KEY entry is deleted and notInUpstreamEnvExample is now empty; the
export stays so the next divergence gets an entry rather than passing quietly.

The stale-path Aside on Connect a game server is pinned to v0.1.0 rather than
calling the installer permanently wrong, and now says WHY the old path is worse
than a 404: the SPA has no route for it, so it redirects to the dashboard and
the link looks like it worked.

v0.1.0 is still the current download, and not only because releases lag. The
release run for installer#22 built every artifact and pushed tag v0.1.1, then
took a 500 creating the release -- so the tag is orphaned and no binaries were
published. Raised on installer; nothing is worked around here.

This also recovers 084ee0b, which was pushed to feat/phase-7-docs after PR #10
had already merged f499f2b, and so never reached main.

Co-Authored-By: Claude <noreply@anthropic.com>

PLAN.md

@@ -909,12 +909,19 @@ Hero editor into Branding and theming, Web Bot Activity into Authentication.
   it is **missing from website's root `.env.example`**, the file Compose actually reads. It is
   present in `server/.env.example`, which is the file local development copies, which is why this
   has never bitten anyone in dev. The quickstart carries it, declared as an upstream omission so the
-  check fails the day it is fixed.
+  check fails the day it is fixed. **Fixed in website#163** (merged 2026-08-24), which also adds
+  `BOT_INTERNAL_KEY` to the README's "set at least" list — required in production even on a
+  deployment running no bot. The declaration did exactly what it was built to do: this repo went red
+  on the next run, and the entry is deleted here.
 - **The installer points operators at a screen that no longer exists.** It prints
   `<site>/admin/shard`, and INSTALL.md §5 repeats it. Since the module-system cutover a module owns
-  one path segment, and the screen is **`/admin/uo/link`**, labelled *Shard (uo-link)*. Both the
+  one path segment, and the screen is **`/admin/uo/link`**, labelled *Shard (uo-link)*. The old path
-  binary (`installer` `main:src/sidecar.rs`) and the guide are stale; the journey documents the real
+  does not even 404 — the SPA sends the operator to the dashboard, so the link looks like it worked
-  path and says the printed one does not resolve.
+  and the four values have nowhere to go. **Fixed in installer#22** (the path is a named constant and
+  both handoff tests assert it) **and docs#174**, both merged 2026-08-24. The note here is pinned to
+  **v0.1.0** because that is still the current download: the release run for the fix built every
+  artifact and pushed tag `v0.1.1`, then took a `500` creating the release, leaving the tag orphaned
+  and no binaries published. That is an `installer` problem, not this repo's, and is raised there.
 - **The admin "Restart the server" button opens a `window.confirm`.** Its text is the honest
   warning that a deployment with no supervisor does not come back — which is exactly why
   `restart: unless-stopped` is called out as load-bearing on the install page rather than left as

src/content/docs/docs/getting-started/connect-a-game-server.mdx

@@ -106,10 +106,15 @@ sidebar — `/admin/uo/link`. Tick *Enable the shard integration*, paste **Base
 **WebSocket URL**, **Auth token** and **Protocol**, and save. The ingest client restarts
 immediately.
 
-<Aside type="caution" title="The installer prints an older path for that screen">
+<Aside type="caution" title="Installer v0.1.0 prints an older path for that screen">
-It prints `…/admin/shard`. Since the shard screens became part of the `uo` module, a module
+It prints `…/admin/shard`. Since the shard screens became part of the `uo` module — and a
-owns one path segment and the screen moved to **`/admin/uo/link`**. Use the sidebar, or
+module owns one path segment wherever it appears — the screen moved to **`/admin/uo/link`**.
-that path; the printed link no longer resolves.
+
+The old path does not fail visibly: the site has no route for it, so it sends you to the
+dashboard, and that looks like the link worked. The four values you were just told to paste
+then have nowhere to go. Use the sidebar, or the path above.
+
+Corrected in the installer's `main`; v0.1.0 is still the current download.
 </Aside>
 
 The token is encrypted at rest and **never returned to any client** — losing it means

src/data/quickstart.mjs

@@ -110,22 +110,21 @@ export const env = [
 ];
 
 /**
- * `SECRET_ENC_KEY` is in this quickstart and NOT in upstream's `.env.example`, which is why
+ * Keys this quickstart sets that upstream's `.env.example` does not, each with the reason.
- * it needs a declaration rather than passing quietly.
  *
- * Found by booting this exact file against the published image (phase 7): the server calls
+ * **Empty, and that is the point.** Its one entry was `SECRET_ENC_KEY`: phase 7 booted this
- * `resolveKey()` in `utils/secretBox.js` at require time and throws
+ * exact file against the published image and the container crash-looped before it ever
- * `SECRET_ENC_KEY must be set in production`, so the container crash-loops before it ever
+ * listened, because `resolveKey()` in `utils/secretBox.js` throws
- * listens. It is documented in `server/.env.example` — the file local development copies —
+ * `SECRET_ENC_KEY must be set in production` at require time. The variable was documented in
- * and missing from the root `.env.example` that Compose actually reads.
+ * `server/.env.example` — the file local development copies — and missing from the root
+ * `.env.example` that Compose actually reads.
  *
- * The check treats the omission as upstream's bug, not as licence: it fails the moment the
+ * The declaration was written so it could not outlive the defect: the check fails the moment
- * variable appears in `.env.example`, so this note cannot outlive the defect it describes.
+ * a declared key appears upstream. website#163 fixed `.env.example`, this repo went red on
+ * the next run, and the entry was deleted. Keep the export — the next divergence gets an
+ * entry here rather than passing quietly.
  */
-export const notInUpstreamEnvExample = {
+export const notInUpstreamEnvExample = {};
-  SECRET_ENC_KEY:
-    "the app refuses to start in production without it (utils/secretBox.js), but website's root .env.example does not list it",
-};
 
 /**
  * Variables upstream's `.env.example` carries that the quickstart leaves out, each with the