Summary

Adds an opt-in setup wizard (./scripts/setup) and read-only doctor (./scripts/doctor) under a new setup/ Python package. Streamlines first-time onboarding without modifying any SDK source files.

This PR is opened as a draft — the wizard is purely additive, but it's a UX decision whether the maintainers want it shipped here vs. as a separate companion repo. Happy to take it any direction.

What the wizard does (3-step picker)

1. Java + Gradle preflight — verifies JDK 8+ and the Gradle wrapper.
2. Auth credentials — inner picker for Developer Token / JWT / CCG / OAuth, then captures the right credentials and writes them to box-config.properties at the repo root.
3. Smoke test snippet — prints a 4-line copy-pasteable Java program that authenticates and calls users.getUserMe(), keyed to the chosen auth mode.

The doctor re-runs each step's check function so users can audit "what's wired up?" without rerunning the wizard.

What this adds

What this does NOT touch

• src/ — zero SDK source changes
• build.gradle — no new Gradle tasks
• README, CONTRIBUTING, docs/* — left alone

The wizard is fully opt-in. Existing flows continue to work; users who prefer the README's manual setup are unaffected.

Design principles

The patterns are distilled in setup-wizard-squared — paced output, picker-first, env injection, doctor-symmetry, idempotence, progress watchdog, self-containment. See that repo's reference/patterns.md for rationale.

Test plan

• ./scripts/doctor reports 4 OK / 1 WARN / 0 FAIL on a fresh clone (the WARN being "no box-config.properties yet" — the wizard's job to fix).
• ./scripts/setup walks the picker, accepts 1, 2, 3, 1-3, all, recommended, none, blank.
• ./scripts/setup followed by step 2 → Developer Token → 64-char fake token → box-config.properties written.
• ./scripts/doctor after the above reports 5 OK / 0 WARN / 0 FAIL.
• Re-running ./scripts/setup and picking step 2 again surfaces "Existing auth mode: Developer Token. Re-collect / change auth mode?" — idempotent.
• python3 -c "from setup import wizard, doctor" from repo root imports cleanly.
• Round-trip with a real Developer Token + smoke snippet against a Box account (deferred — needs reviewer to mint a token).
• Test on a fresh machine without the JDK installed — should [FAIL] with a clean install hint.

Open questions for reviewers

1. Scope: Does this belong in the SDK repo, or as a separate box-java-sdk-onboarding companion?
2. Python dependency: The wizard uses Python 3.10+ stdlib only (no extra packages). Is "Python on the user's machine" an acceptable wizard prerequisite for a Java SDK? If not, I can rewrite as a Gradle init plugin or shell-only.
3. Smoke compile: I deliberately did NOT add a gradle smoke task — that's a maintainer decision. Happy to add one if wanted.
4. JWT key handling: The wizard captures only the path to the JWT config JSON. It doesn't move the file or change permissions on it. Is that the right boundary?