fix(new-setup): align onecli health path and rework auth flow

onecli step:
- Poll /api/health (was /health) so the step's health check matches
  the probe's. On hosted OneCLI (app.onecli.sh) the old path returned
  non-ok, flagging the gateway as "degraded" even though install
  succeeded.
- Drop the "try `onecli start`" hint — no such subcommand exists and
  it sent the skill off chasing fabricated commands. A failed health
  poll is demoted to a soft warning; the auth step surfaces a real
  outage via `onecli secrets list`.

SKILL.md step 4: rewrite to match the /setup skill's pattern — the
user generates the token themselves, picks dashboard or CLI to
register it with OneCLI, and the skill verifies via `auth --check`.
Tokens no longer travel through chat.

Co-Authored-By: Koshkoshinsk <daniel.milliner@gmail.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/onecli.ts

@@ -106,10 +106,11 @@ function installOnecli(): { stdout: string; ok: boolean } {
 }
 
 async function pollHealth(url: string, timeoutMs: number): Promise<boolean> {
+  // `/api/health` matches the path probe.mjs uses — keep them aligned.
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
-      const res = await fetch(`${url}/health`);
+      const res = await fetch(`${url}/api/health`);
       if (res.ok) return true;
     } catch {
       // not ready yet
@@ -185,10 +186,17 @@ export async function run(_args: string[]): Promise<void> {
     INSTALLED: true,
     ONECLI_URL: url,
     HEALTHY: healthy,
-    STATUS: healthy ? 'success' : 'degraded',
+    // Install succeeded regardless — a failed health poll often just means
+    // the endpoint is auth-gated or the gateway hasn't finished warming up.
+    // The next step (auth) will surface a genuinely broken gateway via
+    // `onecli secrets list`, so don't trigger rescue attempts from here.
+    STATUS: 'success',
     ...(healthy
       ? {}
-      : { HINT: 'Gateway did not respond to /health within 15s. Try `onecli start`.' }),
+      : {
+          HEALTH_HINT:
+            'Health poll returned non-ok within 15s — likely auth-gated. Proceed to the auth step; it will surface a real outage.',
+        }),
     LOG: 'logs/setup.log',
   });
 }