fix(data-warehouse-source): name Stripe's restricted-key scopes and link the docs

context/skills/data-warehouse-source/description.md

@@ -49,7 +49,8 @@ Surface these **before** collecting credentials — they're the top reasons setu
 
 - **The host must be reachable from PostHog's network.** `localhost`, `127.0.0.1`, and private/RFC-1918 hosts (`10.x`, `192.168.x`, `172.16–31.x`) are rejected — PostHog connects from its own infrastructure, not the user's machine. Serverless/managed Postgres (Neon, Supabase, RDS behind strict rules) often also needs PostHog's egress IPs allowlisted first. If the database isn't publicly reachable, go straight to the deep-link path instead of collecting credentials that can't validate.
 - **Supabase has its own source type — use `Supabase`, not `Postgres`.** PostHog lists `Supabase` as a source type of its own, so call `external-data-sources-wizard` with `source_type: "Supabase"` and ask for the fields it returns. Its `host` field carries the Session-pooler guidance in its own caption. Pass that caption on to the user rather than writing your own. The password is the **database** password (Supabase → Settings → Database). It is not an `anon` or `service_role` JWT key, and not the account password. If `SUPABASE_URL` exists in the env, derive the project ref from `db.<ref>.supabase.co` to pre-fill the host and username in your prompt.
-- **Many SaaS sources need a specific key type or plan** — name the right one in your `wizard_ask` prompt so the user doesn't paste the wrong thing: **Stripe** wants a _restricted_ key (`rk_live_…`), not `sk_live_…`; **Sentry** wants an internal-integration token (not a DSN or personal token); **RevenueCat** a v2 secret key with read scopes; **Convex** requires the Professional plan; **Twilio** an API Key SID + Secret (not the account auth token); **Mailchimp** a key with its `-usX` datacenter suffix. For send-only services (Resend, Mailgun) the key in the env is often restricted — the warehouse import needs a full/read-access key.
+- **Many SaaS sources need a specific key type or plan** — name the right one in your `wizard_ask` prompt so the user doesn't paste the wrong thing: **Sentry** wants an internal-integration token (not a DSN or personal token); **RevenueCat** a v2 secret key with read scopes; **Convex** requires the Professional plan; **Twilio** an API Key SID + Secret (not the account auth token); **Mailchimp** a key with its `-usX` datacenter suffix. For send-only services (Resend, Mailgun) the key in the env is often restricted — the warehouse import needs a full/read-access key.
+- **Stripe wants a _restricted_ key (`rk_live_…`), not a secret key (`sk_live_…`).** Name the exact scopes in your `wizard_ask` prompt so the user can check them in one pass instead of guessing: Read on Balance transactions, Charges, Customers, Disputes, Payment methods, Payouts, and Products (Core); Read on Coupons, Credit notes, Invoices, Prices, and Subscriptions (Billing); Read on Connect (if the account uses it); and Write on Webhooks so PostHog can create the real-time sync webhook (optional only if the user will add that webhook manually later). Link the user to https://posthog.com/docs/cdp/sources/stripe#option-1-restricted-api-key-recommended for the exact dashboard steps. Stripe has no URL parameter that pre-selects these scopes when creating a key — don't imply one exists or invent a deep link for it. Tell the user to paste only the key value, with no surrounding text or whitespace.
 
 ## Many `in-cli` sources: work through them one at a time