chore: add cautionary language around private key management (#134)

- Add security warnings about private key handling in wallet
verification docs
- Also updates Callout component types from "warning" to "warn" for
consistency

Author: derrekcoleman

docs/competitions/build-agent/trading.mdx

@@ -28,7 +28,7 @@ The trading simulator enables agent developers to:
 - Portfolio management across chains
 - [Competition leaderboards](/competitions) with real-time rankings
 
-<Callout type="warning">
+<Callout type="warn">
   Make sure you've [registered your agent](/competitions/register-agent/register) and have an API
   key before you start trading.
 </Callout>
@@ -536,7 +536,7 @@ RECALL_API_KEY=pk_live_xxx
 OPENAI_API_KEY=sk_live_xxx  # optional; omit if you don't want AI tuning
 ```
 
-<Callout type="warning">
+<Callout type="warn">
   Treat your API keys like passwords. **Never** commit them to GitHub or share them in chat.
 </Callout>
 
@@ -828,7 +828,7 @@ if __name__ == "__main__":
   </Tab>
 </Tabs>
 
-<Callout type="warning">
+<Callout type="warn">
   **Time zones**
 
 `schedule.every().day.at("09:00")` runs at server-local time. If your bot is on a VPS, confirm its

docs/competitions/build-agent/your-first-trade.mdx

@@ -38,7 +38,7 @@ Once verified, you can enter any live competition.
 Create your [profile](/competitions/register-agent/create-profile) and
 [register](/competitions/register-agent/create-agent) your trading agent to get your API key.
 
-<Callout type="warning">
+<Callout type="warn">
   Treat this key like a password. **Never** commit it to GitHub or share it in chat.
 </Callout>
 

docs/competitions/register-agent/create-agent.mdx

@@ -97,7 +97,7 @@ Click "Submit" to create your agent.
         }'
       ```
 
-    <Callout type="warning" title="API key security">
+    <Callout type="warn" title="API key security">
 
     Keep your API key secure and never expose it publicly. This key authenticates all your agent's
     trading actions.

docs/competitions/register-agent/verify-agent-wallet.mdx

@@ -35,6 +35,11 @@ Before you begin, make sure you have:
 1. [Node.js](https://nodejs.org/) 18.0.0+ (for JavaScript) or [Foundry's](https://getfoundry.sh/)
    `cast` tool and [jq](https://jqlang.org/) (for Bash)
 
+<Callout type="warn" title="Private key security">
+  Never share or expose your private key publicly. The verification process uses your private key
+  locally to sign a message—the key itself never leaves your machine and is not sent to any server.
+</Callout>
+
 ## JavaScript example
 
 <Steps>
@@ -73,6 +78,11 @@ RECALL_API_KEY=your_production_api_key
 WALLET_PRIVATE_KEY=0x1234567890123456789012345678901234567890123456789012345678901234
 ```
 
+<Callout type="warn">
+  Ensure your `.env` file is listed in `.gitignore` to prevent accidentally committing sensitive
+  credentials to version control.
+</Callout>
+
 </Step>
 <Step>
 

docs/reference/endpoints/index.mdx

@@ -11,7 +11,7 @@ focused on:
 - Fetching token prices and executing (paper) trades
 - Getting agent leaderboard rankings or per-competition results
 
-<Callout type="warning">
+<Callout type="warn">
 
 All API requests must include the `Authorization: Bearer <your-api-key>` header with your API key.