Connector Gateway intro: add how it works and full admin scope #1183

Part of #1175. Page: docs/connector-gateway/index.mdx

Problems

1. It doesn't explain how the gateway works or who does what (lines 18-24). The page says what the gateway is, but not how anyone gets value from it. There are two roles:

   • Admins register connectors and grant access.
   • Users connect an MCP client (Claude Code, Claude, Codex, Cursor, VS Code) to a single gateway endpoint and sign in once per connector.

   The only diagram of the flow is on the configure page.

2. "What you administer here" is incomplete, and the sidebar doesn't match the console (lines 38-42). In the console, the Connectors admin nav group has four items: Connectors, Identity Providers, Managed Secrets, and Tool Usage. The docs put identity providers and managed secrets under Platform → Identity and directory, and this list doesn't mention them.

3. The vMCP comparison implies a difference that isn't there (line 32). It lists "multiple authentication methods" as a vMCP advantage, but the Connector Gateway supports five auth types in the console and eight through the API.

4. The directory-groups pointer repeats at lines 19 and 49-51, and access is also policy-based (see Connector Gateway: correct inaccurate claims and stale API spec #1177). "Before you start" (lines 44-47) is a single link.

Recommendations

• Add a short "How it works" section: the request flow (client → gateway → directory policy → connector), plus the admin and user roles, with links to each
• List all four admin areas with links. Consider adding sidebar links to the identity providers and managed secrets pages in connectorGatewaySidebar.
• Turn the vMCP section into a comparison table covering:
  • who picks the tools: admins and users vs. a fixed config
  • how authorization works: per-user connector policy vs. ToolhiveAuthorizationPolicy
  • tool filtering and renaming: users narrow their own tools vs. admin-defined
  • who it's for: people vs. applications
• Link ToolhiveAuthorizationPolicy
• Replace "Before you start" with real prerequisites: gateway deployed (Connector Gateway: fix configure page so the install renders #1176), at least one directory group, and identity providers or managed secrets for connectors that need auth
• State the directory-groups pointer once