feat(embed): candle Metal (Apple Silicon GPU) opt-in build feature + v0.23.0

- kebab-embed-candle: `metal` feature → candle metal backend; select_device()
  picks Device::new_metal(0) (CPU fallback) under the feature, else Device::Cpu.
  .contiguous() before to_vec2 (Metal rejects strided views; CPU tolerates).
- feature passthrough: kebab-app/embed_metal → kebab-cli/embed_metal.
  Build on macOS: cargo build --release --features embed_metal.
- default (non-metal) path unchanged: clippy 0, candle units + thread_cap + parity pass.
- README + HOTFIXES: Mac-GPU-ingest → copy sqlite+lancedb → server CPU-query workflow.
- version 0.22.0 → 0.23.0 (opt-in build surface).

macOS-only compile; Metal execution/speed/parity validated by user on M4 Pro
(not buildable on the Linux CI/dev machine).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/kebab-cli/Cargo.toml

@@ -51,5 +51,10 @@ tempfile     = { workspace = true }
 rusqlite     = { workspace = true }
 time         = { workspace = true }
 
+[features]
+# opt-in (macOS): build the `kebab` binary with candle on the Apple Silicon GPU.
+#   cargo build --release --features embed_metal
+embed_metal = ["kebab-app/embed_metal"]
+
 [lints]
 workspace = true