feat(setup): add contextual help text to all wizard flows

Each setup section now explains what's needed before prompting:
- Providers: links to API key consoles (Anthropic, OpenAI, Gemini, etc.)
- Channels: step-by-step bot creation (Telegram @BotFather, Discord dev
  portal, Slack app setup, WhatsApp QR)
- Gmail: Google Cloud Console OAuth setup walkthrough
- Memory: explains what vector search does and key reuse
- Security: describes each option (sandbox, pairing, tool profiles)
- Gateway: explains auth token, Tailscale Serve, lock mode

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/cli/setup/security.ts

@@ -9,18 +9,29 @@ const TOOL_PROFILES = [
 ];
 
 export async function setupSecurity(p: Prompter, builder: ConfigBuilder): Promise<void> {
+  p.println('  Docker sandboxing runs tool commands in isolated containers.');
+  p.println('  Requires Docker installed and running.');
   const sandbox = await p.confirm('Enable Docker sandboxing?', false);
   if (sandbox) {
     builder.setSandboxEnabled(true);
     p.println('✓ Docker sandboxing enabled');
   }
 
+  p.println();
+  p.println('  DM pairing requires unknown senders to enter a code before chatting.');
+  p.println('  Generate codes via the gateway or TUI /pair command.');
   const pairing = await p.confirm('Enable DM pairing for unknown senders?', false);
   if (pairing) {
     builder.setPairingEnabled(true);
     p.println('✓ DM pairing enabled');
   }
 
+  p.println();
+  p.println('  Tool profiles control which tools the agent can use:');
+  p.println('    full        — all tools available (file, shell, web, memory, messaging)');
+  p.println('    coding      — file system + shell + sessions + memory (no messaging/web)');
+  p.println('    messaging   — send messages only (no file/shell access)');
+  p.println('    minimal     — status checks only (read-only, safest)');
   const profile = await p.choose('Tool policy profile:', TOOL_PROFILES);
   builder.setToolProfile(profile);
 }