docs: name both Connect-an-Agent doors in three published pages (#18573)

Part of #18143

Clause-②: no

## What this changes

Three published documentation pages still sent readers to **Setup →
Connect an
Agent** to reach the Connect-an-Agent page. `SETUP_APP` declares
`requiredPermissions: ['setup.access']`, so that instruction is a dead
end for
every non-admin — and the ruling that made the page reachable for them
was
delivered by a second `navigationContributions` entry into the
**`account`**
app's `grp_account_developer` group, not by opening Setup up. Each line
is
judged on its own; two different fixes result.

| Page | Shape | Fix |
|:--|:--|:--|
| `content/docs/api/index.mdx` | a direct key-minting instruction |
names **both** doors |
| `content/docs/ai/agents.mdx` | descriptive summary that already defers
step-by-step setup to `/docs/ai/connect-mcp` | drops the `Setup → `
prefix only |
| `content/docs/getting-started/build-with-claude-code.mdx` |
descriptive, but its subject is "Admins" | names **both** doors |

**Why `agents.mdx` gets the prefix drop and not the two-door
treatment.** The
paragraph sits under a Callout that already reads *"Step-by-step client
setup
(Claude Code, Claude Desktop, `.mcp.json`, API keys) with verification
and
troubleshooting lives in [Connect an MCP Client](/docs/ai/connect-mcp).
The
summary below covers the architecture."* That page carries the
authoritative
two-door routing. Naming the page without a door removes the false
direction
without duplicating routing into a section that explicitly defers it.

**Why `build-with-claude-code.mdx` cannot be fixed by a prefix drop.**
Its
subject was *"Admins find …"*. Deleting `Setup → ` leaves the sentence
still
telling a non-admin reader that this is somewhere admins go. The subject
is the
drift, so the sentence is rewritten and both doors are named.

Wording for the two-door lines is copied from what already shipped in
`packages/mcp/README.md` and `content/docs/ai/connect-mcp.mdx`.

## Deliberately out of this PR

- `content/docs/deployment/environment-variables.mdx:260` carries the
fourth
instance of the same drift. It is left untouched here because another PR
is
in flight against that file; it will be taken in a follow-up round. That
is
why this PR says `Part of #18143` and not a closing keyword — #18143
stays
  open for that remaining line.
- The four occurrences the card marks *"Deliberately NOT included"*
(`docs/adr/0101-…`, `docs/qa/platform-checklist/areas/ai.json`, and two
`.changeset/*.md` bodies) are dated records — a ruling, a test checklist
and
  published version history. They are history, not drift.

## Facts re-verified for this PR

Tree `objectstack-issue-18143`, revision
`340b6dcf74df4f2e931e26f8fb795ce9b5dbf0cb`:

- `packages/platform-objects/src/apps/setup.app.ts:47` —
`requiredPermissions: ['setup.access']` (control: `:31` `name:
'setup'`).
- `packages/mcp/src/connect-ui.ts` — two `navigationContributions`:
`app: 'setup'` / `group_integrations`, and `app: 'account'` /
`grp_account_developer`; both items `id: 'nav_connect_agent'`, `label:
'Connect an Agent'`.
- `packages/platform-objects/src/apps/account.app.ts:179-181` — `id:
'grp_account_developer'`, `label: 'Developer'`; `:186`
`nav_account_api_keys`.
- `packages/apps/account/src/index.ts:27` — `ACCOUNT_APP_PACKAGE_ID =
'com.objectstack.account'`.

## Changeset

`skip-changeset`, measured rather than assumed. Every `files[]` array in
the
workspace was enumerated (70 packages): the distinct entry set is
`CHANGELOG.md | README.md | api-surface | dist | json-schema | liveness
|
llms.txt | prompts | spec-changes.json | src/**/*.zod.ts`. `files[]`
resolves
relative to each package root and `content/docs/` sits above all of
them, so no
entry can reach it. Firing control for the enumerator: it does report
`@objectstack/lint` shipping `CHANGELOG.md`, and `@objectstack/spec`
shipping
`llms.txt` / `prompts`. Symbol check: three distinctive strings from
this diff
(`copy-paste-ready connect snippet`, `The in-product entry point`,
`scripts, CI, headless agents`) return zero hits across `packages/`,
`apps/`
and `examples/`; the same grep over `content/docs/` hits all three
lines.

## Acceptance notes

- `noted, not filed:` `content/docs/ai/connect-mcp.mdx:104` spells the
admin
door as a bullet whose direct link is
`/_console/apps/com.objectstack.setup/page/connect_agent`,
while the pages fixed here spell the same door only as a breadcrumb.
Purely a
consistency observation, not a defect, and no in-flight PR or reader
path
  depends on it. Successor: none.

## Verification

Text-only change to three MDX pages; no code, no behaviour, no gate and
no
authorization change. Gate families were derived from the diff with
`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack`
and run locally; results are in the dispatch report. Repo-wide scans
belong to
CI.

---
_Generated by [Claude
Code](https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-try-charles

content/docs/ai/agents.mdx

@@ -52,7 +52,7 @@ architecture.
 Every deployment serves MCP at `/api/v1/mcp` by default (a core platform
 capability — set `OS_MCP_SERVER_ENABLED=false` to opt out), with two
 authentication tracks: The in-product entry point is the
-**Setup → Connect an Agent** page: per-client connect snippets, the portable
+**Connect an Agent** page: per-client connect snippets, the portable
 SKILL.md download (`GET /api/v1/mcp/skill`), and API-key minting.
 
 - **OAuth 2.1 (interactive clients — recommended).** Each deployment is its

content/docs/api/index.mdx

@@ -65,8 +65,10 @@ permission model grants anonymous users. Two ways to authenticate:
   `curl -c cookies.txt` / `-b cookies.txt`. On a fresh dev database the seeded
   admin is `admin@objectos.ai` / `admin123`.
 - **API key** (scripts, CI, headless agents): mint one with `POST /api/v1/keys`
-  (the key is shown once), or from **Setup → Connect an Agent** in the Console.
-  Send it as `x-api-key: osk_…` or `Authorization: Bearer osk_…`.
+  (the key is shown once), or from the **Connect an Agent** page in the Console
+  — **Account → Developer** for any signed-in user, **Setup → Connect an Agent**
+  for platform admins. Send it as `x-api-key: osk_…` or
+  `Authorization: Bearer osk_…`.
 
 See [Authentication](/docs/permissions/authentication) for the full identity
 surface (OAuth flows, sessions, providers) and

content/docs/getting-started/build-with-claude-code.mdx

@@ -431,8 +431,9 @@ command (one plugin serves every deployment; the URL is the only input):
 claude plugin marketplace add objectstack-ai/claude-plugin
 ```
 
-Admins find every client's copy-paste-ready connect snippet — plus the SKILL.md
-download and API-key minting — on the **Setup → Connect an Agent** page.
+Every client's copy-paste-ready connect snippet — plus the SKILL.md download and
+API-key minting — lives on the **Connect an Agent** page: **Account → Developer**
+for any signed-in user, **Setup → Connect an Agent** for platform admins.
 
 For headless callers (CI, scripts), mint an API key instead
 (`POST /api/v1/keys`, shown once) and pass it as a header: