refactor!: simplify setup and catalog configuration

[Zacaria]

Closes #50

Intentional setup retirement

The owner approved retiring MCP-only connection setup in favor of bootstrap plus configure_index. Remove the credential-taking configure MCP tool, its unconfigured stdio startup path, and automatic checkout-catalog lookup. Credentials are set up by the operator and saved securely, not supplied through MCP tool arguments.

This deliberately retires a second setup workflow; it is not a claim that its code was dead. Hand-authored and generated catalogs remain supported with the same JSON schema, and existing catalog/profile files are not deleted. Direct environment startup requires an explicit catalog path or configuration-file store.

Supported behavior preserved

• HTTP initialization/session IDs, handshake-free calls, GET/SSE, authenticated DELETE, cross-request cancellation, profile binding, bounded sessions and shutdown from PR feat(server): serve per-caller profiles over HTTP with pluggable cata… #47 are restored. Modern stateless requests remain supported.
• setup connection flags remain accepted through the same Commander option registration and bootstrap runner. Bare setup stays guided; bare bootstrap is connection-only. The duplicate raw-argv parser is gone.
• Real Kibana/Elasticsearch backend and schema variants, credential safety, catalog hashes/atomic writes/CAS protection, authentication, isolation, limits and cancellation remain supported.

Actual cleanup and corrections

• Delete unused source-origin metadata, the unused single-source catalog overload, obsolete migration-only release guards and superseded implementation plans.
• Clean generated root dist before compilation and reject packed JS/declaration outputs without current source. Proven stale deleted modules no longer ship after rebuild.
• Isolate stdio tests from ambient saved profiles; correct onboarding environment cleanup, prompt guarantees and schema-fallback documentation.
• Retain concise accepted installation requirements and historical live-backend observations rather than deleting unique evidence.

Verification

• npm run verify: 371 tests / 44 files, types, lint, formatting, build, isolated copied-plugin handshake/discover, release contract and packlist passed.

• npm run docs:build and git diff --check passed.

• Independent source review: 21-path correction PASS, all 68 PR paths reconciled, 127 focused tests passed. The subsequent documentation-only delta review passed against final tree 420d9d8271567002ab17b1335f46ee7b5fe28285; every runtime, test, packaging and schema blob is unchanged from the reviewed source tree b8033e3f866de5ce3c02947bee7639606ec57a74. The owner-approved setup boundary is recorded in docs/project/support-policy.md.

• HTTP suite: 24 legacy + 20 modern cases pass. Byte-unchanged original fixtures pass 23/24 against this candidate; the remaining startup diagnostic difference is intentional for the owner-approved configuration-workflow retirement, not a removed HTTP protocol capability.

• No live Kibana, native credential store, interactive Codex registration, merge, release or deployment claimed.

• PR title follows Conventional Commits.