refactor(tools): bin/{subject}/{method} layout; Go serve+watch modules

Move serve/ (module) -> bin/server, tools/ -> bin/tools, replace bin/kb-watch
bash with bin/watch Go package; self-executing Go shebangs bin/serve.go and
bin/kb/watch.go; Docker + CI + git/import + docs repointed. Multi-stage image
builds static serve+watch binaries (no Go runtime in container).

bin/tools/test_crm_facts.py

@@ -0,0 +1,46 @@
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import crmfacts  # noqa: E402
+
+FM = """\
+schema: 2
+meta:
+  title: x
+orgs:
+- id: produktor
+  label: ProProdukt SL / produktor.io
+  kind: own
+  period: 2006–present
+  website: https://produktor.io
+- id: dyvenia
+  label: Dyvenia
+  kind: employer
+  period: 2023–2025
+clients:
+- name: One
+- name: Two
+timeline:
+- start: 2001
+"""
+
+
+class CorpusOrgsTest(unittest.TestCase):
+    def test_parses_label_kind_period(self):
+        orgs = crmfacts.corpus_orgs(FM)
+        self.assertEqual(orgs["produktor"]["label"], "ProProdukt SL / produktor.io")
+        self.assertEqual(orgs["produktor"]["kind"], "own")
+        self.assertEqual(orgs["dyvenia"]["kind"], "employer")
+
+    def test_does_not_leak_clients_into_orgs(self):
+        orgs = crmfacts.corpus_orgs(FM)
+        self.assertNotIn("One", orgs)
+        self.assertNotIn("Two", orgs)
+        self.assertNotIn("timeline", orgs)
+
+
+if __name__ == "__main__":
+    unittest.main()