UX fixes for our setup flow

[max-mitchell]

This fixes a bunch of things which came up during the onboarding calls this week, in no particular order of importance. I didn't fix anything which I thought might need some discussion, but if you think something is wrong or should be talked about more, just leave a comment.

• New "Where things are in the Dtwo Hub" section in the setup skill: sidebar items, the account menu holding Setup guide, how to reach a gateway's page and where its tabs sit, that Gateway
  URL and Callback URL live in Configuration → Authentication (collapsed by default), and the ⋯ menu for deploy, publish, and delete. Rewrote the four vague Hub pointers in the setup
  skill, plus five more across the gateway-config, gateway-policy, and policy-rego skills.
• Corrected six places claiming an evalNamespace / package mismatch causes problems. It is a per-pipeline step label the Hub fills with step_, the deploy parses the package from
  the Rego source, and the string never reaches the gateway. Blanket-deny and silent-deny troubleshooting now point at the real causes.
• Removed Mermaid entirely. The host-detection branch handed it to "any chat surface", which caught Claude Desktop, where it prints raw source. One plain-text list everywhere now, with an
  explicit "never use Mermaid" and the reason.
• The connection check now separates "tool missing from the tool list" (fall back to the Hub) from "tool present, call errored" (retry, naming the stale-session and OAuth-in-progress
  cases). Added a rule never to tell the user to switch AI clients.
• Connection details are treated as working material rather than a report: no URL, client id, audience, or issuer unless the user must paste it somewhere, and never to announce that one
  isn't needed. The "I'll connect it for you" path names the server and stops.