docs(red-team): follow-up fixes to Quick Start

[Aryansharma28]

Summary

Follow-up polish for the Red Teaming Quick Start page (#324) after a careful re-read against best-in-class docs (Stripe / OpenAI / LangWatch).

• Step 2 — API key discoverability. The LANGWATCH_API_KEY placeholder had no hint about where to get a key. Added a one-liner pointing to app.langwatch.ai → Settings → API Keys.
• Step 4 — soften test commands. The hardcoded pytest tests/red_team/ and npm test -- tests/red-team assumed a directory structure the MCP may not produce, and omitted the long per-test timeouts red team runs actually need. Replaced with "run your tests, or ask your coding assistant to run and monitor it for you" + explicit cost/time awareness (50 turns × LLM calls on two models = real tokens).
• Step 5 — drop "(optional)". Viewing the run in LangWatch is the natural next step, not an aside.

Test plan

• Quick Start renders without errors
• "Settings → API Keys" link resolves to app.langwatch.ai
• Step 4 no longer shows broken path assumptions
• No regressions to the Python/TS code-group in Step 3

🤖 Generated with Claude Code

[github-actions]

Automated low-risk assessment

This PR was evaluated against the repository's Low-Risk Pull Requests procedure.

• Scope: Update docs/docs/pages/advanced/red-teaming/quick-start.mdx: add API key discoverability hint (link to app.langwatch.ai → Settings → API Keys), replace specific pytest/npm commands with generic test/run guidance and timeout/cost warnings, and remove “(optional)” from Step 5.
• Exclusions confirmed: no changes to auth, security settings, database schema, business-critical logic, or external integrations.
• Classification: low-risk-change under the documented policy.

The changes are limited to documentation text in the Quick Start page: clarifying where to get an API key, replacing hardcoded test commands with generic guidance and timeout/cost notes, and adjusting step wording. There are no code, authentication/authorization, secrets management, database, business‑critical, or third‑party integration changes, so it meets the low-risk criteria.

This classification allows merging without manual review once all required CI checks are passing and branch protection rules are satisfied.