docs: clarify Signal message encryption and Windows PATH after install (#979)

* docs: clarify Signal message encryption and Windows PATH after install

- how-netbird-works: the Signal candidate message uses NaCl box
  (Curve25519, XSalsa20, Poly1305): a shared key derived from the
  local private key and the remote public key, no separate signature.
  Spell that out so readers with an RSA sign-then-encrypt model do not
  read the sentence as a mistake.
- windows install: both installers add C:\Program Files\NetBird to the
  system PATH, but terminals opened before the install keep the old
  PATH. Add a note to open a new terminal, and use the full exe path in
  the scripted install + setup-key snippets, where the same shell runs
  both commands.

* docs: state that Signal sees the peers' public keys, not the body

* docs: keep bare netbird up in the setup-key snippets, note a new terminal instead

* docs: drop the repeated new-terminal note from the setup-key section

src/pages/get-started/install/windows.mdx

@@ -10,6 +10,9 @@ The NetBird client allows a peer to join a pre-existing NetBird deployment. If a
 2. Execute the installer and proceed with the installation steps
 3. This will install the UI client in the `C:\Program Files\NetBird` and add the daemon service
 4. After installing, you can follow the steps from [Running NetBird with SSO Login](#running-net-bird-with-sso-login).
+<Note>
+    Open a new terminal before running `netbird` commands. The installer adds `C:\Program Files\NetBird` to the system `PATH`, but terminals that were already open keep the old `PATH`.
+</Note>
 <Note>
     To uninstall the client and service, you can use Add/Remove programs
 </Note>