Brings Photon in line with how every other Hermes gateway channel
behaves, instead of being a one-off with its own surfaces.
- gateway setup: register a `setup_fn` so Photon appears in
`hermes gateway setup` (the unified wizard) and runs the same
device-login + project + user + sidecar flow as `hermes photon setup`.
Adds `cli.gateway_setup()` as the zero-arg entry point.
- PII redaction: flip `pii_safe` False -> True. The comment already
said iMessage E.164 numbers should be redacted; the value contradicted
it. Now matches BlueBubbles (the other iMessage channel) which is in
_PII_SAFE_PLATFORMS — phone numbers are stripped before reaching the LLM.
- Pairing/authz: already worked via the registry's allowed_users_env /
allow_all_env generic path in authz_mixin; documented it. The adapter
forwards unauthorized DMs to the gateway (no intake gating), so the
pairing handshake fires and `hermes pairing approve photon <CODE>` works.
- Docs: fixed the `hermes photon status` output block to match the real
labels (project key / webhook key, not project secret / webhook secret),
added the missing PHOTON_API_HOST / PHOTON_DASHBOARD_HOST /
PHOTON_HOME_CHANNEL_NAME env vars, and added gateway-setup +
authorize-users sections mirroring the other channel docs.
Validation: 26/26 photon tests, 6504/6504 gateway+plugins tests, registry
E2E confirms setup_fn dispatch + pii_safe + authz envs all wired.
d7f42e368e