feat: prepare OAuth onboarding and inbox plugin release

[cjortuzar]

Plugin onboarding previously steered unauthenticated users toward CLI login or API keys, and its bundled instructions did not describe the native inbox and signup experience. Version 0.1.3 guides users through OAuth account connection, preserves their requested WhatsApp connection path, and uses conversation cards and the inbox UI for reviewed replies.

Changes

• Add OAuth-first account creation, project approval, and original-request continuation guidance to all three skills. Direct API and CLI guidance remain available for explicitly requested developer workflows.
• Describe native signup path selection, conversation cards, and editable inbox drafts. Keep app-only mutation tools in the user-operated UI and discover tool availability before using them.
• Update Codex listing metadata, release notes, review scenarios, and installation instructions. Retain the existing submission identifier, ON_INSTALL authentication policy, and https://api.kapso.ai/mcp endpoint.
• Update packaging checks to use Bun, add its lockfile, and document backend deployment and MCP rescan prerequisites.

Validation

• Schema checks passed for 5 manifests; release validation passed for 213 files.
• JavaScript syntax checks passed for 117 files.
• Offline integration tests: 33 passed, 0 failed.
• Built kapso-0.1.3-codex.zip with 178 files. Checked ZIP integrity, submission identity/version, and the OAuth-only production MCP configuration; no local test plugin identity, environment files, dependencies, or Git metadata are included.
• Local Codex UI installation confirmed the account connection prompt appears during installation. This does not establish production readiness for the new review scenarios.

Release dependency

Depends on Cientos PR #2999. Deploy its backend/UI changes and complete the hosted MCP tool scan before testing or publishing this package. Production OAuth, Meta callback acceptance, inbox reviewed sends, the dedicated review account, and the walkthrough recording remain release verification steps.

Upload the complete ZIP to the existing OpenAI plugin submission after verification. This PR prepares the package; it does not deploy the backend, upload a submission, or publish a release.

[cjortuzar]

@codex review