feat: KBDB self-hosted 查詢 + embed 模組 + thin-shell 收窄 + search_workflow（code done 待端到端）

按 issue 分段標明（檔 #5/#8 改動交疊處無法乾淨拆檔，故併一個 commit）：

#4 thin-shell §3.1 自力救濟階梯 + code-node 規則（純文檔/規則，code-node 零件未實作）
#5 KBDB source filter（json_extract metadata_json 零建表）+ 能力對照；documents 聚合與
   DELETE proxy 部分擱置等頂層 T8
#7 base embed 模組（kbdb/src/embed.ts）+ vectorize 開關（deploy/config/wrangler.toml 註解範本）
   + 語義查詢降級閉環（mode=semantic 未開→LIKE+capability_hint）
#8 部分（workflow-discovery）：
   - KBDB /entries/search 加 base 通用 entry_type filter（entry-crud/embed/route/kbdb-proxy 透傳）
   - /webhooks/named 強制 description（空→400，訊息要求操盤 AI 據實寫一句）
   - 部署雙寫 entry_type=workflow embeddable entry（waitUntil 非阻塞，供 search）
   - cypher GET /workflows/search + MCP u6u_search_workflows（優先語意、降級 hint）
   - cypher POST /workflows/backfill-search-entries（無 desc 列出不編造）
   - GET /webhooks/named 補回 description/created_at 欄位（為 list 來源收斂備）

⚠️ tsc 綠 = code done，非完成（mindset §7 禁假綠）：
- #7/#8 端到端待 leo21c 部署驗（Vectorize 需官方憑證、CC 跑不了）
- #8 ①-a（MCP deploy 改打 /webhooks/named）未做、MCP deploy 那半仍 404
- #8 端到端（強制填擋空/語義命中/租戶隔離/降級 hint）未驗

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

kbdb/src/actions/entry-crud.ts

@@ -57,6 +57,7 @@ export interface ListEntriesFilter {
   owner_id?: string;
   parent_id?: string;
   page_name?: string;   // exact-match lookup (e.g. skill-/example- idempotency key)
+  source?: string;      // filter by metadata_json.$.source (ingest envelope source.uri). issue #5.1
   limit?: number;
   offset?: number;
 }
@@ -68,6 +69,9 @@ export async function listEntries(db: D1Database, f: ListEntriesFilter = {}): Pr
   if (f.owner_id) { conds.push('owner_id = ?'); params.push(f.owner_id); }
   if (f.parent_id) { conds.push('parent_id = ?'); params.push(f.parent_id); }
   if (f.page_name) { conds.push('page_name = ?'); params.push(f.page_name); }
+  // source is queryable via SQLite json_extract on the existing metadata_json TEXT column —
+  // no new column / no migration (表不變鐵律). Per issue #5.1 (頂層化 source 成可查 filter).
+  if (f.source) { conds.push("json_extract(metadata_json, '$.source') = ?"); params.push(f.source); }
   const where = conds.length ? `WHERE ${conds.join(' AND ')}` : '';
   const limit = Math.min(f.limit ?? 100, 1000);
   const offset = f.offset ?? 0;
@@ -107,10 +111,18 @@ export async function deleteEntry(db: D1Database, id: string): Promise<void> {
 }
 
 // D1 LIKE keyword search (base; semantic search is the optional embed module).
-export async function searchEntries(db: D1Database, q: string, owner_id?: string, limit = 50): Promise<Entry[]> {
+// entry_type: optional base filter (generic — caller passes any type, base stays type-agnostic).
+export async function searchEntries(
+  db: D1Database,
+  q: string,
+  owner_id?: string,
+  entry_type?: string,
+  limit = 50,
+): Promise<Entry[]> {
   const conds = ['content LIKE ?'];
   const params: unknown[] = [`%${q}%`];
   if (owner_id) { conds.push('owner_id = ?'); params.push(owner_id); }
+  if (entry_type) { conds.push('entry_type = ?'); params.push(entry_type); }
   const res = await db
     .prepare(`SELECT * FROM entries WHERE ${conds.join(' AND ')} ORDER BY updated_at DESC LIMIT ?`)
     .bind(...params, Math.min(limit, 200))