Add Skills.sh skill install flow

[kapelame]

Summary

• add a Skills.sh catalog view under the existing Skill Marketplace UI, with browser-safe catalog loading and install actions
• add POST /api/v1/workspaces/{workspaceID}/skills/install to run npx --yes skills add, package the downloaded Skill folder as ZIP, and reuse the existing Skill ZIP import commit flow
• preserve Skills.sh provenance in source_payload and cover full-folder ZIP import, sha256/oss_key, and temp-dir cleanup in tests

Validation

• go test ./server/internal/dev
• pnpm --filter @parsar/web typecheck
• pnpm --dir apps/web exec eslint src/lib/api-skills.ts src/pages/admin/capabilities/SkillsDirectory.tsx src/pages/admin/capabilities/MarketplaceTab.tsx
• real local E2E: installed gws-gmail-triage, bound it to a Pi agent, and completed a conversation run using MiniMax-M3