docs: verify against real WHP + capture real screenshots

Discovery against the demo account on whp01 surfaced several inaccuracies:

- Cache is Valkey (Redis wire-compatible), not Redis or Memcached.
  No Memcached is offered as a separate service.
- Site Monitoring is the sidebar label (not 'AI Monitor').
- 'Add a domain' has no Primary/Add-on distinction.
- Sites form: 'Container Type' (not 'Site type'), Number of Containers
  (1-10 for horizontal scaling), CPU per Container (default 0.25),
  Memory per Container (default 256MB), SSL inline on the same form.
- Backups: default retention 5 days / 10 backups; on-demand + scheduled;
  S3 backup targets are visible and configurable.
- Email: per-domain settings live behind 'Setup Instructions' on the
  Email page; mail server hostname is on the Dashboard (per-server,
  e.g. mail01.cloud-hosting.io), not per-domain.

Also reworked the screenshot pipeline:
- New shots.config.ts targets the real index.php?page=... URLs
- Added redactSensitive() step that runs before each screenshot to swap
  server names, IPs, mail hostnames, and demo-user-isms with neutral
  placeholders. This keeps docs portable across the fleet.
- Hides .brand-full and .navbar-text (top-bar server identifier and
  Welcome greeting).
- Captured 9 real WHP screenshots; removed stale placeholders.

src/content/docs/whp/add-ons/monitoring.mdx

@@ -1,5 +1,5 @@
 ---
-title: Monitoring (AI Monitor)
+title: Site Monitoring
 description: Proactive alerts for site errors, brute-force attempts, and exploit signatures.
 sidebar:
   order: 2
@@ -12,9 +12,9 @@ import Support from '~/content/partials/support-link.mdx';
 
 ## What it does
 
-AI Monitor watches your site's logs, error rates, and access patterns in the background. If something looks unusual — a sustained spike in 500 errors, a brute-force pattern against a login page, a request matching a known exploit signature — you get an alert.
+Site Monitoring watches your site's logs, error rates, and access patterns in the background. If something looks unusual — a sustained spike in 500 errors, a brute-force pattern against a login page, a request matching a known exploit signature — you get an alert.
 
-By default alerts go to the contact email on your account; SMS is available for critical-severity events if you opt in.
+By default, alerts go to the contact email on your account. SMS is available for critical-severity events if you opt in.
 
 ## What's included
 
@@ -26,15 +26,17 @@ By default alerts go to the contact email on your account; SMS is available for
 
 ## How to enable
 
-From the [client portal](https://secure.anhonesthost.com/clientarea.php), go to your hosting service → **Upgrade/Downgrade** → pick Monitoring.
+Site Monitoring is enabled per site. From the [client portal](https://secure.anhonesthost.com/clientarea.php), go to your hosting service → **Upgrade/Downgrade** and pick Site Monitoring.
 
 ## Where it lives in WHP
 
-Once enabled, find it in the sidebar: **Security → AI Monitor**.
+Once enabled, find it in the sidebar: **Site Monitoring**.
 
-![AI Monitor in WHP](~/assets/screenshots/whp/whp-monitor.png)
+![WHP Site Monitoring page](~/assets/screenshots/whp/whp-site-monitoring.png)
 
-You'll see a feed of events, severity badges, and counts. Click an event for the full log context.
+When the add-on isn't enabled, the page reads: *"AI monitoring is not enabled for any of your sites. Contact your hosting provider to enable this feature."*
+
+Once enabled, the page shows a feed of events with severity badges and counts. Click an event for the full log context.
 
 ## Tuning false positives