Workspace skills: provenance fix and per-member learning control #1145

Workspace skills (AI Skills) need a few fixes, and admins need control over whose requests the skill learning may use.

Problems

1. Generating skills deletes suggestions it did not create. generateForServer removes every pending skill of the server before inserting the new ones, including skills filed by skills_save_to_workspace that are waiting for approval. The connector variant removes manually created pending skills the same way. Nothing records where a skill came from, so the generator cannot tell them apart.
2. activeSkillsText reads applied skills by server and connector ids only, without organizationId. The current callers pass ids that are already scoped to one organization, so this is defense in depth, not a leak.
3. The skill endpoints in KgController take plain object bodies instead of class-validator DTOs.
4. Intent capture (_intent) is a single switch for the whole workspace. Admins cannot choose which members' requests are used for learning, and members cannot opt out. In many companies, analysing what an individual employee asks for needs an explicit per-person decision (data protection, works council agreements).

Proposal

• Add source to kg_skill_suggestions (manual, llm, finder). Generation only replaces its own pending llm suggestions. Existing rows are backfilled.
• Filter activeSkillsText by organizationId.
• DTOs for the skill endpoints.
• Per-member learning control on organization_members:
  • learning_mode: inherit (default), on, off, set by an admin per member, with bulk changes in Settings > Users.
  • learning_opt_out: the member can opt themselves out. They can never opt in against the admin.
  • The workspace switch becomes the default for members set to inherit, so current behaviour does not change.
  • Effective rule: not opted out, and on, or inherit with the workspace default on. Callers without an identified user (static instance credentials) never contribute.
  • When it is off for a caller, their tools do not get the _intent parameter and anything they send in it is dropped.
  • Changes are written to the security event log. Switching a member off can also clear the intents already captured from them.

Behaviour is the same on Cloud and self-hosted: settings are per workspace membership, so one person in two workspaces can have different settings.

Migration

One migration: a column on kg_skill_suggestions with a backfill, and two columns with defaults on organization_members. No data is removed.