docs: clarify org setup as primary onboarding path (vs. single-project token)

[AndreHeller]

Problem

The current README and quick-start guide lead with kbagent project add --token YOUR_TOKEN, which requires the user to manually look up and copy a Storage API token for each project. In practice, most users who manage multiple Keboola projects hit a dead end here — the token they try first is often invalid or wrong scope.

The more natural path for most users is kbagent org setup, which creates tokens automatically. But this command is buried after the single-project example.

Suggestion

Restructure the quick-start section to present two explicit variants upfront, so users can pick their path immediately:

Variant A – Org admin (requires Manage API token):

KBC_MANAGE_API_TOKEN=xxx kbagent org setup --org-id 123 --url https://connection.keboola.com --yes

→ Automatically discovers and registers all projects in the organization.

Variant B – Project member (requires Personal Access Token):

KBC_MANAGE_API_TOKEN=<personal_access_token> kbagent org setup --project-ids 123,456 --url https://connection.keboola.com --yes

→ Works without org-admin rights; PAT is available in Keboola UI under Account Settings → Personal Access Tokens.

The single project add --token path can stay as an advanced/manual option, but should not be the first thing a new user sees.

Why

• org setup is safer (tokens are created with minimal scope, named consistently)
• org setup is faster for multi-project setups
• New users don't know where to find a Storage API token, but they can easily generate a PAT

Reported based on real onboarding experience.