feat: add curated Skill Directory

[kapelame]

Summary

• Add a reviewed, embedded Skill Directory under Capabilities -> Marketplace.
• Add the Directory list, detail, and import flow while reusing the existing Capability, Capability Version, Blob Store, workspace binding, and runtime paths.
• Ship the initial curated catalog entries:
  • Anthropic Frontend Design
  • Anthropic Webapp Testing
  • Vercel React Composition Patterns
• Keep the catalog server-authoritative and pin each item to an upstream commit.

Scope

This PR contains the Skill Directory core only:

• Catalog schema, validation, embedded package loading, and source metadata.
• Workspace Skill Directory list/detail/import APIs.
• OpenAPI definitions and generated Store/blob support required by Skill import.
• Capabilities -> Marketplace Skill Directory UI.
• Import of complete Skill packages, including supporting files and upstream licenses.

The following are intentionally excluded and will be delivered separately:

• Additional curated Skill packages.
• MCP Directory changes.
• OAuth and credential binding changes.
• Member Agent Capability permission changes.

Behavior

• Import accepts only a catalog ID; the server supplies the package contents.
• Imported Skills become private workspace Capabilities.
• Import does not bind an Agent, execute scripts, or run third-party content.
• Duplicate imports are idempotent.
• Details expose the complete package contents, not only the top-level SKILL.md.
• Workspace members can import reviewed Skills; viewers can browse only.
• Vendored packages retain their upstream license files.

Verification

• make check passed.
• pnpm --filter @parsar/web build passed.
• Targeted Skill Directory, Skill Catalog, Blob Store, and Store tests passed.
• git diff --check passed.
• Local API returned the three initial catalog items and loaded their package details successfully.

No model or Agent runtime behavior is changed by the Directory core.