feat(KEEP-143): add kh read, kh plugin, kh chain, and remove auth wall

[eskp]

Summary

Removes the auth wall for public commands and adds new developer utilities. No login required for exploring plugins, chains, templates, or reading contract state.

New commands

kh read (alias: kh call) - Direct contract reads via public RPC, no auth needed:

kh read 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 "decimals()" --chain 1
# 6

kh read 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2 "totalSupply()" --chain 1
# 2331078488707269244918678

kh read 0x6B17...d0F "balanceOf(address)" 0xd8dA...045 --chain 1 --rpc-url https://eth.llamarpc.com

kh chain list (alias: kh ch ls) - List supported chains without auth:

kh ch ls
# 1     Ethereum Mainnet   evm     true
# 8453  Base               evm     true
# ...

kh plugin (renamed from protocol) - Browse plugins and integrations without auth:

kh plugin ls
# aave        7
# morpho      32
# uniswap     16
# discord     1
# ...

kh plugin g aave
# aave (7 actions)
#   Aave V3: Supply Asset
#     aave/supply
#     ...

Backward-compat aliases kh protocol, kh pr still work.

Template search - Filter templates by keyword:

kh tp ls monitor
kh tp ls aave

Auth wall removal

• Factory falls back to no-auth HTTP client when no config file exists
• Public endpoints (/api/chains, /api/mcp/schemas, /api/workflows/public) work on fresh install
• No kh auth login required to explore

RPC configuration

Resolution order for kh read:

1. --rpc-url flag
2. KH_RPC_URL env var
3. ~/.config/kh/config.yml rpc.<chainId> (persistent per-chain)
4. Platform defaultPrimaryRpc from /api/chains (cached 1hr)
5. Platform defaultFallbackRpc

# ~/.config/kh/config.yml
rpc:
  1: https://eth-mainnet.g.alchemy.com/v2/xxx
  8453: https://base-mainnet.g.alchemy.com/v2/xxx

Config additions

• rpc map for persistent custom RPC endpoints
• default_org field (for future KH_ORG env var support)

Test plan

• go build ./... passes
• go vet ./... passes
• go test ./... passes (28 packages, 0 failures)
• Manual: kh read 0xA0b8...48 "decimals()" --chain 1 returns 6 (USDC)
• Manual: kh read 0xC02a...c2 "totalSupply()" --chain 1 returns WETH supply
• Manual: kh ch ls lists chains without auth
• Manual: kh plugin ls lists all integrations without auth
• Manual: kh plugin g aave shows 7 actions
• Manual: kh tp ls monitor filters templates
• Manual: kh pr ls backward compat alias works
• Manual: kh read 0xdAC17F...0e "totalSupply()" --chain 1 returns USDT supply (known: returns empty due to proxy contract, same as cast)