Disclose what the agent install token authorizes

Add a 'What this token authorizes' card to the Pulse Agent install
token step (Unraid, Docker, Kubernetes, generic Linux/macOS/Windows
host). Mirrors the disclosure pattern from the PVE Auth flow so a
security-aware user knows up front:

- The token reports host telemetry only
- Read-only by default; assistant control and host shell stay off
  until opted in per host
- Revocable any time from Settings → Infrastructure → Tokens

Reframe the input placeholder from 'Token name (optional)' to
'Token name (optional label for your audit log)' so the optionality
clearly applies to the label, not the token itself.

Add a hover tooltip to TrueNAS and VMware 'Preview impact' buttons
explaining that they show the resources Pulse would ingest without
saving or starting polling.

Normalize the PVE coverage section header from 'Data collection' to
'Collection scope' to match the TrueNAS form's terminology.

frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx

@@ -388,6 +388,7 @@ export const TrueNASCredentialSlot: Component<TrueNASCredentialSlotProps> = (pro
             class={buttonClass}
             onClick={() => void props.state.previewCurrentForm()}
             disabled={props.state.saving() || props.state.testing() || props.state.previewing()}
+            title="Show the resources Pulse would ingest from this connection without saving or starting polling."
           >
             {props.state.previewing() ? 'Previewing…' : 'Preview impact'}
           </button>

frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx

@@ -337,6 +337,7 @@ export const VMwareCredentialSlot: Component<VMwareCredentialSlotProps> = (props
             disabled={
               props.state.saving() || props.state.testing() || props.state.previewing()
             }
+            title="Show the resources Pulse would ingest from this connection without saving or starting polling."
           >
             {props.state.previewing() ? 'Previewing…' : 'Preview impact'}
           </button>

frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx

@@ -291,6 +291,33 @@ export const InfrastructureInstallerSection: Component<InfrastructureInstallerSe
             </p>
           </div>
 
+          <div class="ml-6 rounded-md border border-blue-200 bg-blue-50 p-3 dark:border-blue-800 dark:bg-blue-900">
+            <p class="mb-2 text-sm font-semibold text-blue-800 dark:text-blue-200">
+              What this token authorizes:
+            </p>
+            <ul class="space-y-1 text-xs text-blue-700 dark:text-blue-300">
+              <li class="flex items-start">
+                <span class="mr-2 mt-0.5 text-emerald-500">✓</span>
+                <span>Pulse Agent on this host reports its own telemetry to this Pulse instance.</span>
+              </li>
+              <li class="flex items-start">
+                <span class="mr-2 mt-0.5 text-emerald-500">✓</span>
+                <span>
+                  Read-only by default. Assistant control and host shell stay off until you opt in
+                  per host from <span class="font-medium">Settings → Infrastructure</span>.
+                </span>
+              </li>
+              <li class="flex items-start">
+                <span class="mr-2 mt-0.5 text-emerald-500">✓</span>
+                <span>
+                  Revoke the token any time from{' '}
+                  <span class="font-medium">Settings → Infrastructure → Tokens</span>; the agent
+                  stops reporting immediately.
+                </span>
+              </li>
+            </ul>
+          </div>
+
           <div class="flex gap-2">
             <input
               type="text"
@@ -301,7 +328,7 @@ export const InfrastructureInstallerSection: Component<InfrastructureInstallerSe
                   void state.handleGenerateToken();
                 }
               }}
-              placeholder="Token name (optional)"
+              placeholder="Token name (optional label for your audit log)"
               class="flex-1 rounded-md border border-border bg-surface px-3 py-2 text-sm text-base-content shadow-sm focus:border-blue-500 focus:outline-none focus:ring-2 focus:ring-blue-200 dark:focus:border-blue-400 dark:focus:ring-blue-900"
             />
             <button

frontend-modern/src/components/Settings/NodeModalMonitoringSection.tsx

@@ -68,7 +68,7 @@ export const NodeModalMonitoringSection: Component<NodeModalMonitoringSectionPro
       <Show when={modalProps.nodeType === 'pve'}>
         <div class="space-y-3">
           <SectionHeader
-            title="Data collection"
+            title="Collection scope"
             size="sm"
             class="mb-1"
             titleClass="text-base-content"
@@ -233,7 +233,7 @@ export const NodeModalMonitoringSection: Component<NodeModalMonitoringSectionPro
       <Show when={modalProps.nodeType === 'pbs'}>
         <div class="space-y-3">
           <SectionHeader
-            title="Data collection"
+            title="Collection scope"
             size="sm"
             class="mb-1"
             titleClass="text-base-content"
@@ -329,7 +329,7 @@ export const NodeModalMonitoringSection: Component<NodeModalMonitoringSectionPro
       <Show when={modalProps.nodeType === 'pmg'}>
         <div class="space-y-3">
           <SectionHeader
-            title="Data collection"
+            title="Collection scope"
             size="sm"
             class="mb-1"
             titleClass="text-base-content"