Expand TUI guidance and host detection coverage

docs/COMMAND_REFERENCE.md

@@ -403,10 +403,16 @@ daemon status, recent alert snapshots, incident index and timelines, posture
 findings, integrity/watchdog state, event-rule metadata, event tail, and
 read-only response-plan previews.
 
+Beginner-oriented prompts in each view explain what the data means and suggest a
+safe flow: check Status first, review grouped Incidents, read the Timeline,
+inspect Response Plans, then confirm Integrity. The TUI is read-only; it never
+executes response commands.
+
 Keys:
 
 - `1` / `2` / `3` / `4`: status, alerts, incidents, timelines.
 - `5` / `6` / `7` / `8` / `9`: posture, integrity, rules, events, response plans.
+- `n` / `b`: next/back through the beginner workflow.
 - `j` / `k` or arrows: scroll.
 - `r`: refresh.
 - `/`: filter the current view.
@@ -416,7 +422,8 @@ Keys:
 - `q`: quit.
 
 Command mode supports `status`, `alerts`, `incidents`, `timeline`, `posture`,
-`integrity`, `rules`, `events`, `response`, `help`, `refresh`,
+`integrity`, `rules`, `events`, `response`, `help`, `home`, `guide`, `next`,
+`back`, `refresh`,
 `filter <text>`, `clear`, and `quit`.
 
 ### `web`