kebivo MCP server

A new installation now gets from `docker run` to a routed, signed delivery by copy-paste, with no UI step and no model key.

- `python -m kebivo.cli project create --name "..."` creates a project and prints a `feedback:gap` token once (`--json` for scripts). `bootstrap --password-stdin` reads the admin password from a pipe without warnings.
- The quickstart leads with the published image, uses the real clone URL for the build path, and adds a "Route it" step: run `examples/webhook_receiver.py`, add a webhook destination and rule, and see the receiver verify a signed delivery. A test keeps the documented image tag in step with the package version.
- The project Connect panel has a "Send test event" button that sends a sample gap through normal intake and routing and links to its group. Inbox and dashboard empty states point to it.
- Signing in from an origin that is not allowed now returns a message that lists the configured origins instead of a bare "Invalid Origin".
- Native Slack destination: paste a Slack incoming-webhook URL and Kebivo posts a Block Kit message with the question, project, tags, occurrence count and, when `PUBLIC_URL` is set, a link to the group. The URL is validated to `hooks.slack.com`, stored encrypted and never shown again in full.
- Python client (`sdk/python`, standard library only) and TypeScript client (`sdk/typescript`, ESM, no runtime dependencies, Node 20+) for reporting gaps and corrections, with idempotency keys, bounded retries that honour `Retry-After`, and typed errors. An optional LangChain callback reports a gap when a retriever returns no documents. Install from Git; neither is published to a package index.
- Group detail shows when each occurrence was received.

## Upgrade

One database migration runs automatically when the container starts. It rebuilds the `destinations` table to allow the new Slack type, and existing destinations are kept. No configuration changes are needed. Take a backup as the [self-hosting guide](https://docs.kebivo.com/self-hosting/#upgrades) describes, then pull the new image and recreate the container with the same volume and env file:

```sh
docker pull ghcr.io/ocnai/kebivo:0.2.0
docker rm -f kebivo
docker run -d --name kebivo --restart unless-stopped -p 127.0.0.1:8000:8000 \
  -v kebivo-data:/data --env-file kebivo.env ghcr.io/ocnai/kebivo:0.2.0
```

The image is `ghcr.io/ocnai/kebivo:0.2.0` (also tagged `latest`) for `linux/amd64` and `linux/arm64`.

## Links

- Changelog: [CHANGELOG.md](https://github.com/OCNAI/kebivo/blob/v0.2.0/CHANGELOG.md)
- Quickstart: [docs.kebivo.com/quickstart](https://docs.kebivo.com/quickstart/)