fix: support Hermes reconnects and add Xquik search

[kriptoburak]

Summary

• accept Hermes' current connect(is_reconnect=...) platform contract
• add an optional, native, read-only xquik_search tool
• bundle a namespaced Xquik social research Skill
• document configuration, data flow, pagination, and untrusted-content handling
• bump the plugin version to 0.2.3

Independent Fix

Fixes #2.

Hermes 0.17 and newer pass is_reconnect to every platform adapter. The old
Kapso signature rejected that keyword before the webhook listener could bind.
The adapter now accepts the exact core contract. Kapso uses push webhooks, so it
does not need a server-side reconnect queue policy.

Xquik Integration

The plugin now registers xquik_search through Hermes' native tool registry and
bundles kapso:xquik-social-research.

The integration:

• supports Latest and Top search, X operators, post IDs, status URLs, limits,
  and pagination cursors
• reads XQUIK_API_KEY only from the environment
• sends credentials only to the fixed HTTPS Xquik endpoint
• refuses redirects and bounds input, response, post text, and cursor sizes
• filters returned fields and accepts only matching X status permalinks
• marks all post and profile content as untrusted data
• returns safe errors without response bodies, credentials, or private details

Search results return to Hermes. Hermes decides what to summarize or send
through the existing Kapso WhatsApp adapter.

Validation

• uv run --python 3.11 --isolated --with '.[test]' pytest -v: 56 passed
• pytest-cov: 100% statement and branch coverage for xquik_tool.py
• strict mypy: clean
• scoped Ruff check and format: clean
• Bandit: clean
• pip-audit: no known dependency vulnerabilities
• Skill, Markdown, YAML, TOML, and manifest consistency checks: clean
• Radon: A maintainability grade and A average complexity
• Xquik, Xquik docs, Kapso, and Kapso docs links: HTTP 200

Xquik is an independent third-party service. Not affiliated with X Corp.
"Twitter" and "X" are trademarks of X Corp.