Fix setup.ps1: correct execution order and add API_TOKEN generation

Bug: API_TOKEN replacement ran before .env existed, and before the
existence check. On a clean clone the script errored immediately.

Fixed flow: banner → existence check → generate SECRET_KEY →
generate API_TOKEN → copy .env.example → replace both keys.

Also adds MCP connection info to output (matching setup.sh).

setup.ps1

@@ -1,7 +1,4 @@
 # Diligence — Windows Setup
-# Generate API_TOKEN for MCP connector auth
-$apiToken = -join ((48..57) + (65..90) + (97..122) | Get-Random -Count 32 | ForEach-Object {[char]$_})
-(Get-Content .env) -replace '^API_TOKEN=.*', "API_TOKEN=$apiToken" | Set-Content .env
 
 Write-Host "`n`e[36m💪 Diligence — Setup`e[0m`n"
 
@@ -15,11 +12,14 @@ $bytes = New-Object byte[] 32
 [System.Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
 $secret = ($bytes | ForEach-Object { $_.ToString("x2") }) -join ""
 
-# Create .env from template
-Copy-Item .env.example .env
-(Get-Content .env) -replace "^SECRET_KEY=.*", "SECRET_KEY=$secret" | Set-Content .env
+# Generate random API_TOKEN (32 alphanumeric chars)
+$apiToken = -join ((48..57) + (65..90) + (97..122) | Get-Random -Count 32 | ForEach-Object {[char]$_})
 
-Write-Host "`e[32m✅ .env created with random SECRET_KEY`e[0m"
+# Create .env from template and replace both keys
+Copy-Item .env.example .env
+(Get-Content .env) -replace "^SECRET_KEY=.*", "SECRET_KEY=$secret" -replace "^API_TOKEN=.*", "API_TOKEN=$apiToken" | Set-Content .env
+
+Write-Host "`e[32m✅ .env created with random SECRET_KEY and API_TOKEN`e[0m"
 Write-Host ""
 Write-Host "Next steps:"
 Write-Host "  docker compose up -d"
@@ -27,3 +27,6 @@ Write-Host "  Open http://localhost"
 Write-Host "  Register your account"
 Write-Host "  Configure integrations via Settings or your AI agent"
 Write-Host ""
+Write-Host "MCP agent connection:"
+Write-Host "  URL: http://localhost:3001/sse"
+Write-Host "  Header: Authorization: Bearer $apiToken"