fix(codemode): canonicalize namespace filters safely

[jmagar]

Adversarial-review follow-up for Code Mode namespace casing and Labby-owned MCP App visibility.

Namespace resolution

• Canonicalizes only caller-supplied upstreams and namespaced tools filters against configured upstream names.
• Exact casing wins first; a unique ASCII case-insensitive match falls back to the canonical configured name.
• Ambiguous case-only aliases fail closed instead of widening generic ToolScope authorization semantics.
• Protected-route authorization remains exact after canonicalization.
• Avoids cloning the full gateway config on every Code Mode call by taking a small upstream-name snapshot.

MCP App visibility findings addressed

• Labby-owned MCP App UIs now default off while text Code Mode remains enabled.
• Adds Skill Library to the shared mcp_app switchboard and all behavior.
• Skill Library UI metadata, resources, app revision catalog entries, manager UI controls, persistence, startup logging, and docs now honor the visibility switch.
• The underlying artifacts text service remains usable while its UI is disabled.
• Reduced-feature builds explicitly keep Skill Library UI off when the gateway switchboard is absent, rather than referencing gateway-only configuration.

CI/adversarial follow-up

• Replaced the manual all-false McpAppsConfig::default implementation with a derived default to satisfy Clippy.
• Fixed fs and skills reduced-feature slices by gating every Skill Library visibility read behind the gateway feature or an explicit false fallback.
• Corrected the route-tools regression: synthetic Code Mode intentionally hides raw artifacts, so the bulk-disable test now verifies UI/resource hiding without asserting a raw descriptor that the route contract suppresses.

Verification

• cargo fmt --all and git diff --check pass.
• cargo check -p labby-gateway -p labby --lib passes.
• MCP App default-off and persistence/restart regressions pass.
• Exact local Clippy, fs, and skills CI lanes pass after the follow-up fixes.
• Fresh CI is the authoritative route-tools/live/browser matrix.