docs(connectors): add remote harness setup guide

[NicholaiVogel]

Summary

Add a user-facing remote harness connector guide that walks from daemon prep through API-key creation, connector install, first-run checks, troubleshooting, and security notes.

Changes

• Add docs/REMOTE-CONNECTORS.md as the end-to-end cross-machine setup guide.
• Link the guide from Harnesses, CLI, Auth, Connectors, and Quickstart docs.
• Document API-key management routes in the HTTP API reference.
• Clarify remote connector auth/scoping caveats for 0.140.1:
  • named key per connector/machine
  • matching --agent-id where supported
  • Codex 0.140.1 does not yet persist SIGNET_AGENT_ID
  • hook traffic is authenticated, but not every hook path is a hard agent-scope boundary
• Update stale connector package examples in the portable connector spec to @signetai/*.
• Update latest migration reference to 078-api-keys.ts.

Type

• feat — new user-facing feature (bumps minor)
• fix — bug fix
• refactor — restructure without behavior change
• chore — build, deps, config, docs
• perf — performance improvement
• test — test coverage
• docs — documentation only

Packages affected

• @signet/core
• @signet/daemon
• @signet/cli / dashboard
• @signet/sdk
• @signet/connector-*
• @signet/web
• predictor
• Other: docs only

Screenshots

N/A — docs only.

PR Readiness (MANDATORY)

• Spec alignment validated (INDEX.md + dependencies.yaml)
• Agent scoping verified on all new/changed data queries
• Input/config validation and bounds checks added
• Error handling and fallback paths tested (no silent swallow)
• Security checks applied to admin/mutation endpoints
• Docs updated for API/spec/status changes
• Regression tests added for each bug fix
• Lint/typecheck/tests pass locally

Docs-only PR; code/test checklist items are N/A but checked after confirming no runtime code changed.

Migration Notes (if applicable)

N/A — no database migrations.

• Migration is idempotent
• Daemon Rust parity reviewed or explicitly N/A
• Rollback / compatibility note included in PR description

Testing

• bun test passes
• bun run typecheck passes
• bun run lint passes
• Tested against running daemon
• N/A

Validated:

• git diff --check
• bun scripts/doc-drift.ts routes/migrations are clean
  • remaining package-table summary is pre-existing broad drift in AGENTS.md/README.md
• targeted grep for stale public connector examples / nonexistent commands
• autoreview clean for release-blocking remote connector/API-key documentation accuracy

AI disclosure

• No AI tools were used in this PR
• AI tools were used (see Assisted-by tags in commits)

Notes

The guide intentionally documents shipped 0.140.1 behavior, including the current Codex SIGNET_AGENT_ID caveat and hook scope-enforcement caveat, rather than promising future isolation semantics.