feat(host-agent): default planner transport to cloud

docs/CLOUD_DEPLOYMENT.md

@@ -384,29 +384,17 @@ The Host Agent reuses the local Runtime planner. Unlike the shared Runtime
 library (whose own default is the deterministic stub planner), the **Host
 Agent defaults `AI_PLANNER_ENABLED` to on** -- it is the actual device-control
 path, so goal assignments use a model unless an operator explicitly opts out.
-Provide provider credentials before deploying:
+With `AI_PLANNER_TRANSPORT` unset, the Host Agent uses the **`cloud`**
+transport. Configure an active Cloud Provider profile before deploying; without
+one, every planning step raises immediately and the task fails on its first
+step (no silent fallback to the stub planner). Set `AI_PLANNER_ENABLED=false`
+to opt back out to the deterministic stub planner (e.g. for offline/dev hosts
+with no provider credentials).
 
-```text
-AI_PLANNER_PROVIDER=anthropic
-AI_PLANNER_MODEL=claude-sonnet-5
-AI_PLANNER_TIMEOUT_SECONDS=30
-ANTHROPIC_API_KEY=<secret manager reference>
-```
+### Cloud-proxy transport (default)
 
-Without a valid API key, every planning step raises immediately and the task
-fails on its first step (no silent fallback to the stub planner). Set
-`AI_PLANNER_ENABLED=false` to opt back out to the deterministic stub planner
-(e.g. for offline/dev hosts with no provider credentials).
-
-For OpenAI, set `AI_PLANNER_PROVIDER=openai`, choose the deployed model through
-`AI_PLANNER_MODEL`, and provide `OPENAI_API_KEY`. This is the **`direct`
-transport** (the default): the Host Agent holds provider credentials and
-calls Anthropic/OpenAI itself.
-
-### Cloud-proxy transport (`AI_PLANNER_TRANSPORT=cloud`)
-
-Set `AI_PLANNER_TRANSPORT=cloud` on the Host Agent to instead route every
-planning decision through the Cloud API's
+With `AI_PLANNER_TRANSPORT` unset or set to `cloud`, every planning decision
+routes through the Cloud API's
 `POST /internal/v1/hosts/{host_id}/planner/decide` endpoint (the same
 host-scoped bearer credential used for heartbeat/claim/renew/result). In this
 mode:
@@ -440,8 +428,22 @@ mode:
     latency, error class) and never prompt text or screenshot bytes, but the
     request bodies themselves do cross the network to the control plane.
 
-`AI_PLANNER_TRANSPORT` unset or `direct` preserves the existing
-direct-to-provider behavior with no change.
+### Direct transport (explicit opt-out)
+
+Set `AI_PLANNER_TRANSPORT=direct` only for Hosts that must call a provider
+without the Cloud proxy. Those Hosts hold their own provider credentials:
+
+```text
+AI_PLANNER_TRANSPORT=direct
+AI_PLANNER_PROVIDER=anthropic
+AI_PLANNER_MODEL=claude-sonnet-5
+AI_PLANNER_TIMEOUT_SECONDS=30
+ANTHROPIC_API_KEY=<secret manager reference>
+```
+
+For OpenAI, set `AI_PLANNER_PROVIDER=openai` and provide `OPENAI_API_KEY`.
+Direct Hosts are not covered by Cloud token budgets or Cloud-side Provider key
+rotation.
 
 ### Host governance and Cloud-proxy token budgets
 

docs/MACOS_IPHONE_SETUP.md

@@ -389,17 +389,23 @@ uv run --package device-host-agent device-host-agent setup
 缓存身份不存在时，Host Agent 会直接向云端注册，由云端返回 `host_id`；后续运行
 使用本地持久化的随机 Host secret。无需配置静态 Host 或 enrollment token：
 
+Host Agent 的 Planner transport 默认是 `cloud`。启动前在 Cloud Console 创建并激活
+LLM Provider profile；Provider API key 只由 Cloud API 加密保存，边缘 Host 不需要也
+不应配置厂商 API key。
+
 ```bash
 export HOST_AGENT_IDENTITY_PATH="tasks/host_identity.json"
 export HOST_AGENT_DISPLAY_NAME="Edge Mac 01"
 
 export AI_PLANNER_ENABLED="true"
-export AI_PLANNER_PROVIDER="anthropic"
-export ANTHROPIC_API_KEY="<secret>"
 
 uv run --package device-host-agent device-host-agent
 ```
 
+只有需要绕过 Cloud API 时，才显式设置
+`AI_PLANNER_TRANSPORT=direct`，并在该 Host 上配置
+`AI_PLANNER_PROVIDER`、`AI_PLANNER_MODEL` 与对应的厂商 API key。
+
 首次启动顺序为：持久化候选 Host secret、向云端换取 `host_id`、为每个本地设备
 换取 `device_id`、保存映射、连接 WDA、发送 heartbeat、开始 long-poll 领取任务。
 Host Agent 会在本机回环地址提供 Console。必须保留并保护 `tasks/host_identity.json` 和