docs: reframe macOS/Linux as the easy connect path (not "use this link")

Per the project owner: on *nix the connect is ready out of the box —
WireGuard ships with the OS, and sentinel-dvpncli is self-interactive and
self-documenting (no install, no flags, no steps to document). Payment is
identical on every platform (x402 USDC on Base); only the connect differs.
Windows is the heavier path (manual WireGuard, admin, setup()/V2Ray).

- OS chips: macOS/Linux status "CLI" -> "easiest" (.os-chip.cli renamed
  to .os-chip.easy, still accent-blue/positive).
- Hero copy: replaced the amber "warn" caveat with a neutral .plat-note —
  same payment everywhere; macOS & Linux easy (CLI runs itself, just tell
  your agent "pay and connect to Austria"); Windows heavier JS-SDK path.
- Fedora called out as the sole exception (SELinux blocks VPNs, can't be
  worked around) in an amber .plat-warn span; macOS/Ubuntu/mainstream
  Linux explicitly fine.

Author: Sentinel-Bluebuilder

docs/index.html

@@ -343,8 +343,8 @@
 .os-chip.soon { color: var(--amber); border-color: rgba(255, 181, 71, 0.32); }
 .os-chip.soon .os-logo { color: var(--amber); filter: drop-shadow(0 0 6px rgba(255, 181, 71, 0.32)); }
 
-.os-chip.cli { color: var(--accent); border-color: rgba(0, 170, 255, 0.32); }
-.os-chip.cli .os-logo { color: var(--accent); filter: drop-shadow(0 0 6px rgba(0, 170, 255, 0.3)); }
+.os-chip.easy { color: var(--accent); border-color: rgba(0, 170, 255, 0.32); }
+.os-chip.easy .os-logo { color: var(--accent); filter: drop-shadow(0 0 6px rgba(0, 170, 255, 0.3)); }
 
 .os-chip .os-label {
   display: inline-flex;
@@ -549,6 +549,26 @@
   margin-bottom: 20px;
 }
 
+.hero .subtitle.plat-note {
+  font-size: 12.5px;
+  color: var(--text-muted);
+  line-height: 1.55;
+  margin-top: 4px;
+  margin-bottom: 20px;
+  max-width: 640px;
+}
+.hero .subtitle.plat-note strong { color: var(--text); font-weight: 600; }
+.hero .subtitle.plat-note code {
+  font-family: var(--font-mono);
+  font-size: 11.5px;
+  color: var(--accent-bright);
+  background: var(--accent-subtle);
+  padding: 1px 5px;
+  border-radius: 4px;
+}
+.hero .subtitle.plat-note .plat-warn { color: var(--amber); }
+.hero .subtitle.plat-note .plat-warn strong { color: var(--amber); }
+
 .hero .code-preview {
   max-width: 540px;
   margin: 0 auto;
@@ -1551,21 +1571,21 @@ <h1 class="fade-in">Private internet<br>for <span class="highlight">AI agents</s
         </span>
         <span class="os-label">Windows <span class="os-status">live</span></span>
       </div>
-      <div class="os-chip cli" title="Connect via Sentinel's CLI tool">
+      <div class="os-chip easy" title="Easiest path — connect works out of the box">
         <span class="os-logo" aria-hidden="true">
           <svg viewBox="0 0 24 24" fill="currentColor"><path d="M16.4 1.3c.1 1.1-.3 2.2-1 3-.6.8-1.7 1.4-2.7 1.4-.2-1.1.3-2.2.9-2.9.8-.9 2-1.5 2.8-1.5Zm3.6 16.4c-.5 1.2-.8 1.7-1.4 2.8-.9 1.5-2.2 3.4-3.9 3.5-1.5 0-1.8-.9-3.8-.9-1.9 0-2.3.9-3.8.9-1.6-.1-2.9-1.8-3.8-3.3-2.5-4.3-2.7-9.4-1.2-12.1 1.1-1.9 2.8-3.1 4.4-3.1 1.5 0 2.5.9 3.8.9 1.3 0 2.1-.9 3.9-.9 1.4 0 3 .8 4.1 2.2-3.6 2-3 7.2 1.7 10Z"/></svg>
         </span>
-        <span class="os-label">macOS <span class="os-status">CLI</span></span>
+        <span class="os-label">macOS <span class="os-status">easiest</span></span>
       </div>
-      <div class="os-chip cli" title="Connect via Sentinel's CLI tool">
+      <div class="os-chip easy" title="Easiest path — connect works out of the box (except Fedora)">
         <span class="os-logo" aria-hidden="true">
           <svg viewBox="0 0 24 24" fill="currentColor"><path d="M12.5 2c-2 0-3.3 1.6-3.3 4 0 1 .2 1.9.4 2.5-.7.5-1.3 1.4-1.8 2.6-.7 1.6-1 3.8-1.7 5.2-.5 1-1.5 1.5-2 2.2-.4.4-.5 1.3.4 1.6.7.2 1.3-.2 1.9-.6.4-.3.9-.4 1.2-.4.4.1.5.5.6 1 .1 1.3 1 2.2 2.9 2.4 1.8.2 4-.4 5.7-.4 1 0 1.7.1 2.3.1.6 0 1-.5 1-1 0-.5-.4-.9-.9-1.3-1.1-1-1.4-2.3-1.8-4-.4-1.6-.9-3.5-2.3-4.7.4-.8.6-1.7.6-2.7 0-2.3-1.3-4-3.2-4Zm-1 3.3c.4 0 .6.5.6 1s-.3 1-.6 1-.7-.5-.7-1 .3-1 .7-1Zm2.1 0c.4 0 .6.5.6 1s-.3 1-.6 1-.7-.5-.7-1 .3-1 .7-1Z"/></svg>
         </span>
-        <span class="os-label">Linux <span class="os-status">CLI</span></span>
+        <span class="os-label">Linux <span class="os-status">easiest</span></span>
       </div>
     </div>
 
-    <p class="subtitle warn fade-in">The JS SDK tunnel is verified on Windows (WireGuard needs admin). On macOS and Linux, connect with Sentinel's CLI tool &mdash; ideally compiled locally: <a href="https://github.com/sentinel-official/sentinel-dvpncli" target="_blank" rel="noopener">sentinel-dvpncli</a>. The payment + provisioning flow (x402 &rarr; subscription + fee grant) is identical on every platform.</p>
+    <p class="subtitle plat-note fade-in"><strong>The agent always pays the same way</strong> &mdash; x402 USDC on Base &mdash; on every platform. What differs is connecting. <strong>macOS &amp; Linux are the easy path:</strong> WireGuard ships with the OS and Sentinel's <a href="https://github.com/sentinel-official/sentinel-dvpncli" target="_blank" rel="noopener">CLI</a> runs out of the box &mdash; interactive, self-documenting, no install or flags. Point any capable AI agent at it (&ldquo;pay and connect to Austria&rdquo;) and it drives itself. <strong>Windows</strong> needs the heavier JS&#8209;SDK path (manual WireGuard, admin, <code>setup()</code> to fetch V2Ray). <span class="plat-warn">Only exception: <strong>Fedora</strong> &mdash; its SELinux blocks VPNs and can&rsquo;t be worked around. macOS, Ubuntu and other mainstream Linux are fine.</span></p>
 
     <div class="use-cases fade-in">
       <div class="uc-panel">