Refactor Tools Hub and add skill creation from reference

[brsbl]

Summary

This PR makes the default-off Tools Hub experiment introduced in #845 easier to maintain, then adds a gated Create from reference action for skills.sh entries.

Maintainability refactor

• Split the shared resource collection into focused modules while preserving its exact 69-export entry point.
• Split Skills registry data, filters, browse UI, installed UI, and route/query state while preserving the exact 21-export SkillsView surface.
• Extract plugin detail, capability, and runtime-activity rendering while preserving the exact three-export ToolsView surface.
• Keep Skills registry contracts canonical in @bb/server-contract; separate server parsing, proxy behavior, and the thin HTTP route.
• Add export-contract tests so internal helpers cannot accidentally become public.
• Make Tools section identity canonical for sidebar navigation, active-section matching, breadcrumbs, and document titles while leaving route declarations explicit.
• Present Skills and Plugins browse loading, error, empty, toolbar, grid, and card behavior through the existing shared resource primitives.

The refactor was audited against the original #407 head and the #845 release head. No original capability is missing beyond the already-understood absent paths: the untracked .otto spec, two stale docs removed by #824, and the host-daemon registry installer/test superseded by the hardened server-owned installer.

Create from reference

• Adds Create from reference beside Install on skills.sh browse cards and detail pages.
• Opens the existing new-thread composer with an editable, unsubmitted skill-creation prompt containing the stable registry ID and URL.
• Keeps the source untouched: the prompt explicitly forbids install, modification, overwrite, or verbatim copying.
• Treats registry metadata and retrieved skill content as untrusted reference material and quotes metadata before placing it in the agent prompt.

Behavior and rollout

• Tools Hub remains default-off behind experiments.toolsHub.
• Existing routes, API responses, SDK/CLI surfaces, and daemon wire contracts remain unchanged.
• Existing import paths remain stable.
• No daemon protocol bump is required.

Validation

• pnpm exec turbo run typecheck --filter=@bb/shared-ui --filter=@bb/app --filter=@bb/server --filter=@bb/server-contract
• Focused app tests: 49 passed, covering Hub section identity/breadcrumbs, sidebar navigation, shared browse presentation, reference creation, and exact 69/21/3 public-export contracts.
• Focused server tests: 77 passed.
• App lint passed with no errors (existing warnings only).
• Prettier and git diff --check passed.
• Live Ladle story registration and module transformation checks passed.
• Independent refactor review returned CORRECT with no findings.