Rework after-install.md around the installer's prompts

The installer already collects plugin.yaml's env vars at install time
and writes them to ~/.hermes/.env, so the file now frames configuration
as a review step instead of first entry. Reordered steps to match
runtime reality: a fresh bot account is in no room and offline until
'hermes gateway restart' runs, so testing before joining a room — or
DMing /join before restarting — could not work. Also: token documented
as an equal alternative to login+password, mention behavior stated as
it actually defaults (require_mention=false), secrets pinned to .env,
markdown cleanup.

AGENTS.md

@@ -50,13 +50,18 @@ behaves, how to configure it. Unambiguous in practice means:
 ### after-install.md
 
 **Hermes Agent displays `after-install.md` to the user right after plugin
-installation — that is the platform-plugin convention, not our timing choice.**
+installation — that is the platform-plugin convention, not our timing choice.
+By then the installer has already walked through `plugin.yaml`'s
+`requires_env`/`optional_env` prompts and written the answers into
+`~/.hermes/.env` (`hermes_setup_fn`, `save_env_value`).**
 
 It is the first instruction anyone reads, ahead of README.md, config files and
 source. Hold it to the same no-ambiguity bar and keep it in step with reality:
 every env var, command and next step printed there must work exactly as
 written, so it moves whenever setup, configuration or first-run behavior
-changes.
+changes. Because the values were just collected, after-install.md treats
+`.env`/`config.yaml` as a **review** step — "check what the installer wrote",
+not "edit these files to begin".
 
 ## Behavioural contract
 

after-install.md

@@ -1,38 +1,67 @@
 ## Chatto Plugin Installed ✅
 
-Next steps. Edit your `~/.hermes/.env` OR `~/.hermes/config.yaml` 
+During installation you were prompted for the Chatto connection details, and
+your answers were written to `~/.hermes/.env`. Next steps: review that
+configuration, restart the gateway so the bot comes online, then bring it into
+a room and try it out.
 
-Environment Variables will take precedence over config.yaml entries.
+**Review your `~/.hermes/.env` or `config.yaml`.** Secrets (passwords, tokens)
+belong in `~/.hermes/.env` only — never in `config.yaml`; non-secret settings
+can live in either file. Environment variables take precedence over
+`config.yaml` entries.
+
+1. Connection details (required)
+
+   Make sure either an existing bearer token:
+
+   ```
+   CHATTO_TOKEN=your-token
+   ```
+
+   …or login plus password is set:
 
-1. Required connection details
    ```
    CHATTO_LOGIN=your-username
    CHATTO_PASSWORD=your-password
    ```
-   To connect to your server, set `CHATTO_BASE_URL`. Default, when not set,
-   is ChattoHQ (`https://chat.chatto.run`)
+
+   Without `CHATTO_BASE_URL` the plugin connects to the public ChattoHQ server
+   (`https://chat.chatto.run`). To use your own server:
+
    ```
    CHATTO_BASE_URL=https://chat.example.com
    ```
 
-2. Home Channel
+2. Home channel (optional)
 
-   Set your Home Channel using the Channel ID** (optional, defaults to first room):
-   ```bash
+   Where cron job output and notifications get delivered. If unset (the usual
+   case — the installer only asks when you enter one), the first watched room
+   is used:
+
+   ```
    CHATTO_HOME_CHANNEL=ROOM_ID_HERE
    ```
 
 3. Restart the Hermes Gateway
+
+   The bot comes online here — the steps below need it running:
+
    ```bash
    hermes gateway restart
    ```
 
-4. Test
-   send a message in a Chatto room mentioning your bot's username.
+4. Add the bot to a room
 
-5. Add the bot to more rooms (optional)
+   The bot sees only rooms its account has joined — membership lives on the
+   Chatto server, survives gateway restarts, and nothing is joined silently on
+   startup. Invite the bot account natively in Chatto, or DM it:
 
-   Invite the bot account natively in Chatto, or DM it:
    ```
    /join ROOM_ID_HERE
-   ```
+   ```
+
+5. Test
+
+   Send any message in a room the bot has joined. By default it answers every
+   room message; only with `CHATTO_REQUIRE_MENTION=true` do channel-kind rooms
+   wait for an @mention (group rooms and DMs answer regardless).