Add Skills API client for registry extension

[JAORMX]

Summary

• The toolhive-registry-server exposes a Skills API as a ToolHive-specific extension under /v0.1/x/dev.toolhive/skills, but the toolhive client has no way to query it. This adds an HTTP client so that registry providers can discover skills.
• Extract shared HTTP client builder and error types into shared.go so both the existing server client and the new skills client reuse identical security controls (private IP policy, auth token injection via auth.WrapTransport, error body size limits via io.LimitReader).
• Add SkillsClient interface with GetSkill, GetSkillVersion, ListSkills, SearchSkills, and ListSkillVersions methods.
• Add RegistryHTTPError with Unwrap() so 401/403 responses are detectable via errors.Is(err, ErrRegistryUnauthorized).
• Migrate existing server client error handling to use the shared RegistryHTTPError type for consistency.

Type of change

• New feature

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Changes

File	Change
pkg/registry/api/shared.go	New: extracted buildHTTPClient helper, RegistryHTTPError/ErrRegistryUnauthorized error types, newRegistryHTTPError helper
pkg/registry/api/skills_client.go	New: SkillsClient interface and mcpSkillsClient implementation with auto-pagination
pkg/registry/api/skills_client_test.go	New: table-driven tests covering get, list, search, pagination, error handling, URL escaping
pkg/registry/api/client.go	Refactored to use buildHTTPClient() and newRegistryHTTPError() from shared.go

Does this introduce a user-facing change?

No. This is an internal client library addition. A follow-up PR will wire it into APIRegistryProvider via a SkillsProvider interface.

Special notes for reviewers

• Separate SkillsClient from Client: The skills API lives under /v0.1/x/dev.toolhive/ (a ToolHive extension), not the core MCP Registry spec. Keeping them as separate interfaces avoids conflating two API contracts.
• Auth-ready from day one: The constructor accepts auth.TokenSource and wraps the transport identically to the server client. When registry auth is fully wired (PR Wire non-interactive registry auth for serve mode #4111), skills auth will work automatically.
• RegistryHTTPError with Unwrap(): Returns ErrRegistryUnauthorized for 401/403, enabling callers to use errors.Is() without inspecting status codes directly.
• Follow-up PR: PR 2 (feat/registry-skills-provider) will add SkillsProvider interface and implement it on APIRegistryProvider/CachedAPIRegistryProvider.

Generated with Claude Code

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

[codecov]

Codecov Report

❌ Patch coverage is 73.13433% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.29%. Comparing base (c18d2fd) to head (97d4682).
⚠️ Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/registry/api/skills_client.go	73.14%	15 Missing and 14 partials ⚠️
pkg/registry/api/client.go	0.00%	5 Missing ⚠️
pkg/registry/api/shared.go	90.47%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4173      +/-   ##
==========================================
+ Coverage   69.22%   69.29%   +0.07%     
==========================================
  Files         464      466       +2     
  Lines       46639    46774     +135     
==========================================
+ Hits        32286    32414     +128     
+ Misses      11880    11872       -8     
- Partials     2473     2488      +15     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

PR size has been reduced below the XL threshold. Thank you for splitting this up!

[github-actions]

✅ PR size has been reduced below the XL threshold. The size review has been dismissed and this PR can now proceed with normal review. Thank you for splitting this up!