docs: sync public pages, API/MCP docs, and guides to actual functionality

[mkreyman]

Why

Audited every public surface an AI agent (or human) reads to understand loopctl — the loopctl.com landing/docs pages, the API discovery endpoints, the README, the MCP server README, the orchestration guide, and the CHANGELOG — against ground truth (router.ex and mcp-server/index.js's TOOLS array). Goal: docs match reality so agents can accurately educate their users about what loopctl does and how to use it.

Four parallel read-only audits produced the findings; each was independently re-verified against source before applying (that caught a wrong count — see below).

What changed

Tool count → 69 (verified against the TOOLS array; the 70th name: is the new Server() registration, not a tool)

• Was 57 on the landing/docs pages, 65 in README / mcp-server README / CLAUDE.md.
• Documented the 4 previously-undocumented tools: knowledge_conflicts, knowledge_resolve_conflict, knowledge_curation_log, knowledge_retrieval_metrics.

README

• UI-test endpoints corrected to /projects/:project_id/ui-tests (the documented /ui_test_runs paths were unreachable — 404).
• GET / serves the HTML landing page (it does not redirect).
• Added a Chain-of-Custody v2 dispatch-pattern note to the auth flow (env-var keys are the deprecated path).

Orchestration guide

• verified_status values are unverified/verified/rejected (doc said pass/fail, which aren't in the enum).
• Agents report reported_done (doc said completed).
• initial_verified_status on import is honored only for a superadmin caller and its only value is verified — documented the anti-RBAC-bypass guard (the old example used a user key + "pass", which silently produced non-verified stories).
• Clarified reject semantics (auto_reset_on_rejection).

mcp-server README

• knowledge_export has no obsidian format, and its download needs LOOPCTL_USER_KEY.

MCP server version

• The handshake advertised version: "1.2.0" while the npm package is 2.30.0 — an unintentional divergence. Now derived from package.json at startup so it tracks the package version and can't drift again.

Public pages / discovery (code)

• GET /api/v1/ now returns discovery, routes, wiki, and mcp_server pointers so agents hitting the API root have a path forward instead of dead-ending (+ OpenAPI schema + test).
• GET /api/v1/routes is now described as a curated index (not the exhaustive surface), points to the OpenAPI spec, and lists the CoC v2 dispatch routes, recover-cap, acceptance_criteria, and the new knowledge endpoints.
• Wiki index category order is derived from the categories actually present (drops retired :convention, includes all active categories) so no article is ever silently hidden.
• Landing page: "three agent-facing roles" (the hierarchy has four incl. superadmin).

CHANGELOG

• Backfilled the shipped agents'-KB endpoints (conflict resolution/merge, retrieval metrics, curation log, creativity primitives) that had no CHANGELOG entry.

Verification

• mix precommit green: 3091 tests, 0 failures; compile (warnings-as-errors), mix format, credo --strict, and dialyzer all clean.
• Every claim edited was checked against source (router.ex, story.ex enum, import_export.ex superadmin gate, index.js tool defs/handlers, export format enum).

Notes

• The mcp-server README's 1.2.0 deprecation notes are unchanged and still accurate — they describe when the knowledge_agent_usage parameter behavior changed, not the current server version.