docs: close residual Windows-100 gaps in READMEs + manifest

Every Managed-flow connect() example and the /manifest flow now
explicitly pass protocol: 'v2ray' so a Windows agent without admin
gets the zero-admin auto-installing path instead of silently picking
WireGuard and failing.

- README.md: hero snippet + "Connect as an agent" Quick Start
- server/README.md: /instructions response example
- server/src/index.ts: /manifest flow[8] + nativeMacLinux note
  (setup() clarified as optional; connect() auto-fetches the binary)

Author: Sentinel-Bluebuilder

README.md

@@ -24,7 +24,8 @@ const res = await paidFetch('https://x402.sentinel.co/vpn/connect/30days', {
 });
 
 const { subscriptionId, feeGranter, nodeAddress } = await res.json();
-const vpn = await connect({ mnemonic: wallet.mnemonic, subscriptionId, feeGranter, nodeAddress });
+const vpn = await connect({ mnemonic: wallet.mnemonic, subscriptionId, feeGranter, nodeAddress, protocol: 'v2ray' });
+// protocol:'v2ray' = zero admin on Windows, binary auto-installs (~70% of nodes).
 // vpn.connected === true — agent's IP is now a Sentinel node, zero gas paid
 ```
 
@@ -163,6 +164,7 @@ const vpn = await connect({
   nodeAddress: provision.nodeAddress,
   subscriptionId: String(provision.subscriptionId),
   feeGranter: provision.feeGranter,
+  protocol: 'v2ray', // zero admin on Windows, binary auto-installs (~70% of nodes)
 });
 
 console.log(`VPN up: ${vpn.ip} via ${vpn.protocol}`);

server/README.md

@@ -105,7 +105,7 @@ Response (after payment):
   "sentinelTxHash": "ABC123...",
   "expiresAt": "2026-04-15T18:50:48Z",
   "operatorAddress": "0xCC689D...",
-  "instructions": "import { connect } from 'blue-js-sdk/ai-path'; await connect({ mnemonic, subscriptionId: 1192288, feeGranter: 'sent12e03...' })"
+  "instructions": "import { connect } from 'blue-js-sdk/ai-path'; await connect({ mnemonic, protocol: 'v2ray', nodeAddress: 'sentnode1...', subscriptionId: '1192288', feeGranter: 'sent12e03...' }); // protocol:'v2ray' = no admin; binary auto-installs. gas paid by feeGranter."
 }
 ```
 

server/src/index.ts

@@ -447,14 +447,14 @@ app.get('/manifest', (_req, res) => {
       { step: 5, actor: 'facilitator', action: 'Settle USDC on Base (~2s)' },
       { step: 6, actor: 'server', action: 'Atomic MsgShareSubscription + MsgGrantAllowance on Sentinel' },
       { step: 7, actor: 'server', action: 'Respond 200 with subscriptionId, feeGranter, nodeAddress' },
-      { step: 8, actor: 'agent', action: 'Connect (OS-specific, same 200 fields). macOS/Linux: keys add (printf mnemonic+blank-line | keys add agent --keyring.backend test), tx session-start <nodeAddress> --subscription-id <id> --tx.fee-granter-addr <feeGranter> --tx.from-name agent --keyring.backend test, resolve id via query sessions --account-addr <sent1...> --subscription-id <id> --output-format json, then connect <sessionId>. Windows: setup() once, then connect({ mnemonic, subscriptionId, feeGranter, nodeAddress })' },
+      { step: 8, actor: 'agent', action: 'Connect (OS-specific, same 200 fields). macOS/Linux: keys add (printf mnemonic+blank-line | keys add agent --keyring.backend test), tx session-start <nodeAddress> --subscription-id <id> --tx.fee-granter-addr <feeGranter> --tx.from-name agent --keyring.backend test, resolve id via query sessions --account-addr <sent1...> --subscription-id <id> --output-format json, then connect <sessionId>. Windows: connect({ mnemonic, subscriptionId, feeGranter, nodeAddress, protocol: "v2ray" }) — zero admin, binary auto-installs; setup() is optional.' },
       { step: 9, actor: 'agent', action: 'MsgStartSession (gas paid by operator via fee grant)' },
       { step: 10, actor: 'agent', action: 'Direct WireGuard/V2Ray handshake with node — tunnel up' },
     ],
     install: {
       npm: 'npm install @x402/fetch @x402/evm viem blue-js-sdk',
       note: 'Agent side only — you do NOT clone this repo. The four packages above are the complete set for paying + connecting on every OS. express / @x402/express / dotenv are operator-only; do not install them.',
-      nativeMacLinux: 'The macOS/Linux connect path also needs, OUTSIDE npm: Go 1.24+ (to `go install` sentinel-dvpncli), wireguard-tools (provides `wg-quick`, for WireGuard nodes), and a `v2ray` binary on PATH (for V2Ray nodes). The Windows path needs none of these — setup() fetches them.',
+      nativeMacLinux: 'The macOS/Linux connect path also needs, OUTSIDE npm: Go 1.24+ (to `go install` sentinel-dvpncli), wireguard-tools (provides `wg-quick`, for WireGuard nodes), and a `v2ray` binary on PATH (for V2Ray nodes). The Windows path needs none of these — connect({ protocol: "v2ray" }) auto-fetches the binary (setup() is optional).',
     },
     packages: {
       payment: '@x402/fetch',