Connector Gateway: add quickstart, user, telemetry, troubleshooting #1179

Part of #1175.

The section has no quickstart, no end-user docs, no observability docs, and no troubleshooting. The AI Gateway section covers all of these.

Quickstart

• Add a Connector Gateway quickstart, as the section skeleton requires (Introduction → Quickstart → how-to). Walk through registering one connector, granting a group, connecting a client, and seeing the call in Tool usage.

End-user connections

Users can manage their own connections, but no page describes this.

• Enabling and disabling connections (PUT /v1/me/connections/{id}/enabled)
• Narrowing the tools on a connection (PUT /v1/me/connections/{id}/tool-policy)
• Connection status (ready, needs_auth, connected), and connecting or re-authenticating from Your workspace
• Deciding where this lives: in the Connector Gateway section, or next to roll-out-gateway-clients.mdx

Telemetry and audit logs

These features exist in the gateway chart but are off by default:

• OTLP metrics, traces, and logs (telemetry.otlp.*), and the Prometheus /metrics endpoint on its own listener (default port 9464)
• Audit events (audit.enabled, includeRequestData, includeResponseData), with the event field table (type, component, outcome, subjects.*, target.*, metadata.extra.backend_name) and a log-forwarding example. This can mirror docs/ai-gateway/forward-audit-logs.mdx.

Tool usage prerequisites (needs SME confirmation)

Tool call metering appears to go through a Redis-backed outbox (outbox.enabled) that is off by default and also needs meteringTokenProjection. If so, Tool usage is empty on a default install.

• Confirm with engineering, then document the prerequisite on tool-usage.mdx and the configure page
• While there: link "Review model traffic in the AI Gateway" and add a second Next steps link

Troubleshooting

• A connector in Failure, or silently withheld (unsupported transport or auth type, missing managed secret or identity provider)
• Connections to private IPs refused (allow_private_ips)
• OAuth callback mismatch ({issuer}/oauth/callback)
• A user who can't see a connector (policy mode, group grant, a claim missing from the token)
• Unexpected re-authentication prompts after a provider config change

The end-user section depends on the console labels in #1186.

Smaller editorial fixes

• Remove the :::warning in connectors.mdx that is only a cross-link, and reduce the repeated "connector grants use directory groups" pointer (about 5 pages)
• Expand the tool-usage.mdx description to the 80–150 character guideline