chore: prepare public launch

[MattyMailers]

Summary

Prepares SmartMoving MCP for a first public 0.1.0 launch and external contributors.

What changed

• Adds read-only-by-default safety gates for public installs.
• Requires SMARTMOVING_ALLOW_WRITES=true for POST/PUT/PATCH requests.
• Requires SMARTMOVING_ALLOW_DESTRUCTIVE=true for DELETE requests.
• Redacts SmartMoving API keys from API error messages.
• Adds Vitest and mocked HTTP-client tests covering auth headers, query params, write blocking, destructive blocking, and error redaction.
• Updates CI to run npm run verify.
• Resets package version to 0.1.0 and adds an npm package files whitelist.
• Adds CHANGELOG.md and docs/RELEASE.md.
• Expands contributor docs with operator, endpoint, workflow, and code contribution paths.
• Updates install docs for safe npx-based MCP configuration.

Testing

From mcp-server/:

• npm run verify
• npm pack --dry-run

Safety checklist

• No SmartMoving API keys are included
• No .env or .env.local files are included
• No real customer names, phone numbers, emails, addresses, quote numbers, or payment data are included
• Docs and tests use placeholders or mocked data only
• Destructive/write behavior is clearly documented