docs(mkdocs/admin-console): add Setup Wizard, Settings, Diagnostics, API Keys, Plugin Builder pages with Material tabs/admonitions

Author: Faxbot Agent

mkdocs/docs/admin-console/api-keys.md

@@ -0,0 +1,28 @@
+---
+title: API Keys
+---
+
+# API Keys
+
+Create scoped API keys for apps and integrations.
+
+## Create a key
+
+1) Open Admin → API Keys
+2) Click “Create key” and choose scopes (e.g., `fax:send`, `fax:read`)
+3) Copy the generated token (`fbk_live_<id>_<secret>`) — it’s shown once
+
+!!! tip "Scopes"
+    Use least‑privilege: sending apps need `fax:send`; dashboards often need `fax:read` only.
+
+## Use in requests
+
+```bash
+curl -H "X-API-Key: fbk_live_..." "$PUBLIC_API_URL/fax/{id}"
+```
+
+## Rotate and revoke
+
+- Rotate keys periodically and revoke unused ones
+- Jobs remain readable if the user/account retains access
+

mkdocs/docs/admin-console/diagnostics.md

@@ -0,0 +1,27 @@
+---
+title: Diagnostics
+---
+
+# Diagnostics
+
+Run safe connectivity checks and review provider‑specific tips.
+
+## Tools
+
+- Health: DB/storage/backends readiness
+- Providers: DNS, auth reachability, webhook URL reachability
+- Tunnels: quick tunnel status, logs tail
+
+???+ note "What’s checked"
+    Checks derive from provider traits (e.g., `inbound_verification`, `needs_storage`). Results include remediation links.
+
+## Actions
+
+- Re‑probe a single provider
+- View recommended callback URLs
+- Copy troubleshooting links
+
+See also
+- [Networking & Tunnels](/networking/tunnels/)
+- [Webhooks](/setup/webhooks/)
+

mkdocs/docs/admin-console/plugin-builder.md

@@ -0,0 +1,26 @@
+---
+title: Plugin Builder
+---
+
+# Plugin Builder
+
+Install, build, and upload provider plugins — including inbound providers — without leaving the Admin Console.
+
+## Install
+
+- Browse available plugins and click Install
+- Upload a signed manifest to add custom providers
+
+## Configure
+
+- Provider fields and help links render from the plugin manifest
+- Inbound plugins expose a webhook path and verification mode (HMAC/Basic) and surface a copyable URL
+
+!!! tip "SignalWire inbound"
+    Add a SignalWire inbound plugin here to enable inbound fax delivery. After install, register the shown webhook URL in SignalWire.
+
+## Test
+
+- Run plugin diagnostics from Admin → Diagnostics
+- Use “Simulate inbound” where available to verify storage and Inbox
+

mkdocs/docs/admin-console/settings.md

@@ -0,0 +1,36 @@
+---
+title: Settings
+---
+
+# Settings
+
+Manage outbound/inbound providers, storage, and security.
+
+## Providers
+
+=== "Outbound"
+
+    Select your sending backend. Cloud providers expose credential fields and status callbacks; self‑hosted backends show AMI/T.38 guidance.
+
+=== "Inbound"
+
+    Choose an inbound provider or install one via Plugins. The UI shows the exact webhook URL and verification method with copy‑button.
+
+!!! tip "Traits‑driven UI"
+    The Settings screen renders fields from provider traits — no backend name checks. This guarantees clean isolation and correct guidance.
+
+## Storage
+
+- Local or S3‑compatible storage for inbound PDFs and artifacts
+- Short‑TTL tokens for PDF access; scope‑guarded downloads
+
+## Security
+
+- API Key enforcement (`X-API-Key`)
+- HMAC verification for supported providers; Basic auth for others
+- Optional OAuth/OIDC for Admin login
+
+See also
+- [Webhooks](/setup/webhooks/)
+- [Diagnostics](/admin-console/diagnostics/)
+

mkdocs/docs/admin-console/setup-wizard.md

@@ -0,0 +1,31 @@
+---
+title: Setup Wizard
+---
+
+# Setup Wizard
+
+Configure Faxbot end‑to‑end from a guided flow: outbound provider, optional inbound, storage, and security.
+
+=== "Evaluate (Quick Tunnel)"
+
+    1) Choose a cloud provider (Phaxio, Sinch, SignalWire, Documo, HumbleFax)
+    2) Enter credentials and click Validate
+    3) Open Tools → Tunnels and start a quick tunnel to get a public URL
+    4) Set `PUBLIC_API_URL` and register webhooks where supported
+
+=== "Production (HIPAA)"
+
+    1) Execute a BAA and disable provider document retention (cloud)
+    2) Use a named tunnel or domain (HTTPS)
+    3) Enable inbound with the correct verification (HMAC/Basic)
+    4) Rotate keys and restrict Admin access
+
+!!! tip "Backend isolation"
+    The wizard shows provider‑specific fields only for the selected backend. Links and help are scoped; nothing is mixed across providers.
+
+Next steps
+
+- [Settings](/admin-console/settings/)
+- [Diagnostics](/admin-console/diagnostics/)
+- [Plugins](/admin-console/plugin-builder/)
+