docs: lead Step 1 with WebAuth + seed-to-K1 extraction (everyone, not just CLI users)

[paulgnz]

Every "create your account" surface across the project was telling operators to use proton account:create myagent as the recommended path. That command only works for operators who already control a funded XPR account — which excludes essentially every first-time operator. The audit didn't catch this because it works for the auditors (who all have funded accounts), but it's a wall for new users.

The canonical path is webauth.com — fresh accounts, free, KYC-able, works for everyone. What was missing: the seed-phrase-to-PVT_K1_ extraction step between "I made an account on webauth.com" and "I run proton key:add". This PR closes that gap on every operator surface.

New canonical Step 1 / 2 / 3 (everywhere)

1. Create the agent account at webauth.com → save the 12-word seed phrase offline.
2. Extract the K1 private key from the seed phrase. Two paths:
   • Explorer utility (desktop): explorer.xprnetwork.org/wallet/utilities/format-keys → "Mnemonic to Private Key" → paste seed → copy PVT_K1_
   • WebAuth mobile app: open the account → Backup Wallet → reveal / export private key → copy PVT_K1_
3. Load the key: proton key:add (interactive) or echo "no" | proton key:add PVT_K1_... (hosted consoles).

proton account:create myagent is demoted to a footnote: "if you already control a funded XPR account, this gives you the K1 directly — skip step 2."

Why this matters

A first-time operator hitting the previous Step 1 ran proton account:create and got either a prompt for a creator account they don't have, or an unhelpful EOSIO error about RAM / no sponsor. Then they bounced. The new flow lets every operator complete Step 1.

Surfaces updated

• frontend/src/pages/get-started.tsx — Step 1 split into 3 numbered steps (account creation, seed extraction, keychain load) with two path cards for the extraction step. Subsequent steps renumbered (Deploy → 4, Pillar 2 → 5, Register/build trust → 6).
• create-xpr-agent/template/QUICKSTART.md — same 3-step structure.
• create-xpr-agent/template/README.md — "Creating an Account" block rewritten.
• openclaw/starter/{QUICKSTART,README}.md — synced (CI scaffold-sanity).
• openclaw/README.md (npm landing page) — keychain setup expanded with both extraction paths.
• docs/SECURITY.md — Flow A now names the two extraction paths explicitly.

Versions

• @xpr-agents/openclaw → 0.4.4 (README content only)
• create-xpr-agent → 0.6.1 (template QUICKSTART + README changes)

Verification

• Frontend builds clean (all 13 routes prerendered)
• 80 openclaw tests pass
• CI scaffold-sanity (start.sh, setup-security.sh, .env.example diffs unchanged this PR)