docs: fix heading numbering and add missing section onboarding.md (#3461)

docs/start/onboarding.md

@@ -23,7 +23,10 @@ wizard, and let the agent bootstrap itself.
 7. **Onboarding chat** (dedicated session)
 8. Ready
 
-## 1) Local vs Remote
+## 1) Welcome + security notice
+Read the security notice displayed and decide accordingly.
+
+## 2) Local vs Remote
 
 Where does the **Gateway** run?
 
@@ -39,7 +42,7 @@ Gateway auth tip:
 - If you disable auth, any local process can connect; use that only on fully trusted machines.
 - Use a **token** for multi‑machine access or non‑loopback binds.
 
-## 2) Local-only auth (Anthropic OAuth)
+## 3) Local-only auth (Anthropic OAuth)
 
 The macOS app supports Anthropic OAuth (Claude Pro/Max). The flow:
 
@@ -50,12 +53,12 @@ The macOS app supports Anthropic OAuth (Claude Pro/Max). The flow:
 Other providers (OpenAI, custom APIs) are configured via environment variables
 or config files for now.
 
-## 3) Setup Wizard (Gateway‑driven)
+## 4) Setup Wizard (Gateway‑driven)
 
 The app can run the same setup wizard as the CLI. This keeps onboarding in sync
 with Gateway‑side behavior and avoids duplicating logic in SwiftUI.
 
-## 4) Permissions
+## 5) Permissions
 
 Onboarding requests TCC permissions needed for:
 
@@ -65,12 +68,12 @@ Onboarding requests TCC permissions needed for:
 - Microphone / Speech Recognition
 - Automation (AppleScript)
 
-## 5) CLI (optional)
+## 6) CLI (optional)
 
 The app can install the global `openclaw` CLI via npm/pnpm so terminal
 workflows and launchd tasks work out of the box.
 
-## 6) Onboarding chat (dedicated session)
+## 7) Onboarding chat (dedicated session)
 
 After setup, the app opens a dedicated onboarding chat session so the agent can
 introduce itself and guide next steps. This keeps first‑run guidance separate