docs(anthropic): clarify api key and doctor recovery

docs/help/faq.md

@@ -565,7 +565,7 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
   <Accordion title="What does onboarding actually do?">
     `openclaw onboard` is the recommended setup path. In **local mode** it walks you through:
 
-    - **Model/auth setup** (provider OAuth, Claude CLI reuse, and API keys supported, plus local model options such as LM Studio)
+    - **Model/auth setup** (provider OAuth, API keys, Anthropic legacy setup-token, plus local model options such as LM Studio)
     - **Workspace** location + bootstrap files
     - **Gateway settings** (bind/port/auth/tailscale)
     - **Channels** (WhatsApp, Telegram, Discord, Mattermost, Signal, iMessage, plus bundled channel plugins like QQ Bot)
@@ -581,14 +581,17 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
     **local-only models** so your data stays on your device. Subscriptions (Claude
     Pro/Max or OpenAI Codex) are optional ways to authenticate those providers.
 
-    We believe Claude Code CLI fallback is likely allowed for local,
-    user-managed automation based on Anthropic's public CLI docs. That said,
-    Anthropic's third-party harness policy creates enough ambiguity around
-    subscription-backed use in external products that we do not recommend it
-    for production. Anthropic also notified OpenClaw users on **April 4, 2026
-    at 12:00 PM PT / 8:00 PM BST** that the **OpenClaw** Claude-login path
-    counts as third-party harness usage and now requires **Extra Usage**
-    billed separately from the subscription. OpenAI Codex OAuth is explicitly
+    For Anthropic in OpenClaw, the practical split is:
+
+    - **Anthropic API key**: normal Anthropic API billing
+    - **Claude subscription auth in OpenClaw**: Anthropic told OpenClaw users on
+      **April 4, 2026 at 12:00 PM PT / 8:00 PM BST** that this requires
+      **Extra Usage** billed separately from the subscription
+
+    Our local repros also show that `claude -p --append-system-prompt ...` can
+    hit the same Extra Usage guard when the appended prompt identifies
+    OpenClaw, while the same prompt string does **not** reproduce that block on
+    the Anthropic SDK + API-key path. OpenAI Codex OAuth is explicitly
     supported for external tools like OpenClaw.
 
     OpenClaw also supports other hosted subscription-style options including
@@ -603,30 +606,27 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS,
   </Accordion>
 
   <Accordion title="Can I use Claude Max subscription without an API key?">
-    Yes, via a local **Claude CLI** login on the gateway host.
+    Yes, but treat it as **Claude subscription auth with Extra Usage**.
 
-    Claude Pro/Max subscriptions **do not include an API key**, so Claude CLI
-    reuse is the local fallback path in OpenClaw. We believe Claude Code CLI
-    fallback is likely allowed for local, user-managed automation based on
-    Anthropic's public CLI docs. That said, Anthropic's third-party harness
-    policy creates enough ambiguity around subscription-backed use in external
-    products that we do not recommend it for production. We recommend
-    Anthropic API keys instead.
+    Claude Pro/Max subscriptions do not include an API key. In OpenClaw, that
+    means Anthropic's OpenClaw-specific billing notice applies: subscription
+    traffic requires **Extra Usage**. If you want Anthropic traffic without
+    that Extra Usage path, use an Anthropic API key instead.
 
   </Accordion>
 
   <Accordion title="Do you support Claude subscription auth (Claude Pro or Max)?">
-    Yes. Reuse a local **Claude CLI** login on the gateway host with `openclaw models auth login --provider anthropic --method cli --set-default`.
+    Yes, but the supported interpretation is now:
 
-    Anthropic setup-token is also available again as a legacy/manual OpenClaw path. Anthropic's OpenClaw-specific billing notice still applies there, so use it with the expectation that Anthropic requires **Extra Usage**. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth).
+    - Anthropic in OpenClaw with a subscription means **Extra Usage**
+    - Anthropic in OpenClaw without that path means **API key**
 
-    Important: We believe Claude Code CLI fallback is likely allowed for local,
-    user-managed automation based on Anthropic's public CLI docs. That said,
-    Anthropic's third-party harness policy creates enough ambiguity around
-    subscription-backed use in external products that we do not recommend it
-    for production. Anthropic also told OpenClaw users on **April 4, 2026 at
-    12:00 PM PT / 8:00 PM BST** that the **OpenClaw** Claude-login path
-    requires **Extra Usage** billed separately from the subscription.
+    Anthropic setup-token is still available as a legacy/manual OpenClaw path,
+    and Anthropic's OpenClaw-specific billing notice still applies there. We
+    also reproduced the same billing guard locally with direct
+    `claude -p --append-system-prompt ...` usage when the appended prompt
+    identifies OpenClaw, while the same prompt string did **not** reproduce on
+    the Anthropic SDK + API-key path.
 
     For production or multi-user workloads, Anthropic API key auth is the
     safer, recommended choice. If you want other subscription-style hosted