docs: add app screenshots for visual guidance across the guide

Several guide pages were text-heavy with no visuals. Add a relevant app
screenshot to each dry section:

- security: the consent dialog in the OAuth Security section
- gateway: the Settings page (gateway port, startup, updates) in Starting
  and Stopping
- workspaces: the FeatureSet detail showing the toolset a folder resolves to
- feature-sets: the effective-features view; also reframe the stale
  "assign per client" note to workspace-driven routing

Validated by building discover.ui against the docs (164 pages, every image
resolves from the live screenshots).

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

docs/guide/feature-sets.mdx

@@ -98,11 +98,13 @@ FeatureSets can **contain other FeatureSets**. This lets you build hierarchical
 4. Add members — select features or other FeatureSets
 5. Set each member to include or exclude mode
 
-### Assigning to Clients
+### Putting a FeatureSet to work
 
-FeatureSets are assigned to clients per Space. Go to the **Clients** page, select a client, and manage its FeatureSet grants for each Space.
+A FeatureSet becomes a session's toolset when a folder routes to it — map the folder in the [Workspaces](/docs/workspaces/) tab (or let the AI pin it with [Tool Optimization](/docs/tool-optimization/)). Sessions whose folder isn't mapped fall back to the active Space's FeatureSet.
 
-A client's effective permissions are the combination of all its granted FeatureSets, with exclude rules taking priority.
+The effective toolset is the combination of the resolved FeatureSet(s), with exclude rules taking priority. McpMux shows exactly what resolves:
+
+![Effective features resolved for a session — the tools, prompts, and resources it can actually use](https://mcpmux.com/screenshots/client-permissions.png)
 
 ## Next Steps
 

docs/guide/gateway.mdx

@@ -78,7 +78,9 @@ Control the gateway from the **Dashboard** in McpMux:
 - **Start Gateway** — begins listening on `localhost:45818` and connects to enabled servers
 - **Stop Gateway** — disconnects all servers and stops accepting requests
 
-The gateway also starts automatically when McpMux launches (configurable in Settings).
+The gateway also starts automatically when McpMux launches, and you can change the port it binds to — both from **Settings**.
+
+![Settings — software updates, startup behavior, and the gateway port](https://mcpmux.com/screenshots/settings.png)
 
 ## Gateway Status
 

docs/guide/security.mdx

@@ -84,6 +84,8 @@ For servers using OAuth 2.1, McpMux implements the full security specification:
 - **Encrypted storage** — both access and refresh tokens are encrypted at rest
 - **Consent UI** — OAuth authorization requests show a consent dialog in the desktop app, ensuring the user explicitly approves each connection
 
+![Consent dialog — every new app connection must be explicitly approved in the desktop app](https://mcpmux.com/screenshots/clients.png)
+
 ## Deep Link Security
 
 When McpMux receives an OAuth authorization request via deep link (`mcpmux://authorize?request_id=xxx`):

docs/guide/workspaces.mdx

@@ -40,6 +40,10 @@ Open the **Workspaces** tab and click **Add mapping**:
 
 Unmapped folders receive no tools until you map them — an explicit, fail-closed default so a new project never silently inherits another's access.
 
+The FeatureSet you pick is the exact toolset the folder resolves to — choose which tools, prompts, and resources from each server it's allowed to use:
+
+![The FeatureSet a folder resolves to — pick exactly which tools each server contributes](https://mcpmux.com/screenshots/featureset-detail.png)
+
 ## Let the AI map it for you
 
 You don't have to open the Workspaces tab at all. With [Tool Optimization](/docs/tool-optimization/), an assistant can compose a FeatureSet and pin the current folder to it from chat: