Phase 0 foundation: canonical schema, ingest pipeline, CRM MCP server

Workstream A–C substrate for the Ten31 agentic system:
- A1: docs/crm-overview.md; CLAUDE.md conventions + guardrail #9
- A2: additive/reversible core migration (canonical_entities, entity_links,
  interaction_log, relationship_edges, soft-delete) + ledgered runner
- B1/B3: chunking + deterministic entity resolution (backend/ingest)
- B2: dense (bge-m3) + BM25 sparse ingest to Qdrant crm_chunks
- C: CRM MCP server (reads, retrieval modes, logged writes) — no outbound tools
- docs: redaction/re-hydration, Gmail enablement runbook
- synthetic test data; .env.example; housekeeping (.gitignore, untrack crm.db,
  drop legacy files + start9/0.3.5)

Verified end-to-end on synthetic data + live Sparks (hybrid > dense on entity
queries). Real backfill runs on Ten31 infra; index holds synthetic data only.
Branch snapshot also captures pre-existing working-tree changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

start9/0.4/seed/README.md

@@ -0,0 +1,58 @@
+# Seed Snapshot (baked into the Docker image)
+
+Anything under `seed/data/` is copied into the container image at build time
+and placed at `/app/seed/data/`. On first boot, if `/data/crm.db` is not
+present on the StartOS service volume, `docker_entrypoint.sh` copies
+`/app/seed/data/.` into `/data/.` so the new 0.4 install starts with the
+preserved data instead of an empty database.
+
+## What's currently baked in
+
+Initial snapshot was taken from the repo-level `data/` directory at build
+time (the same DB that the 0.3.5 dev workflow pointed at). Files:
+
+- `seed/data/crm.db` — SQLite database (investors, contacts, fundraising
+  rows, views, feature_requests, users, app_settings, etc.)
+- `seed/data/backups/*.json` — app-level snapshot exports
+
+## Refreshing the seed before a build
+
+If you want the 0.4 deploy to come up with the absolute latest production
+state from the 0.3.5 StartOS server, replace the files in `seed/data/`
+BEFORE running `make`:
+
+```sh
+# 1) On the 0.3.5 StartOS server, take a fresh app backup and/or grab
+#    the live database file:
+#      /media/embassy/services/ten-database/data/crm.db         (canonical)
+#      /media/embassy/services/ten-database/data/backups/*.json (optional)
+#      /media/embassy/services/ten-database/data/.crm-secret    (optional)
+#    Exact path may differ by StartOS 0.3.5 build.
+#
+# 2) scp them into this folder:
+scp embassy@<old-host>:/media/.../ten-database/data/crm.db \
+    start9/0.4/seed/data/crm.db
+# (Optional) include backups + secret:
+scp embassy@<old-host>:/media/.../ten-database/data/backups/* \
+    start9/0.4/seed/data/backups/
+scp embassy@<old-host>:/media/.../ten-database/data/.crm-secret \
+    start9/0.4/seed/data/.crm-secret
+#
+# 3) Rebuild:
+cd start9/0.4 && make clean && make x86
+```
+
+## Keeping `.crm-secret` out of the image
+
+By default `seed/data/.crm-secret` is NOT included. The first boot on the
+new machine generates a fresh JWT secret. Existing password hashes in
+`crm.db` remain valid, so users just log in once on the new host.
+
+If you WANT to preserve the exact secret (so already-issued JWTs remain
+valid), drop the file at `seed/data/.crm-secret` and rebuild.
+
+## Safety
+
+The entrypoint never overwrites an existing `/data/crm.db`. If the volume
+already contains data (StartOS restore, manual SSH pre-seed, prior install)
+the seed is skipped and a `.seeded` marker is written.