feat(experts): optional allow-skill-details toggle when publishing expert templates

[chujieHong]

…pert templates

Publishing an expert template now supports an allow_skill_details flag (default on). When disabled, users who install the expert can still run its skills but cannot view or modify skill contents:

• stamp skill_details_restricted/protected_skills into the installed agent's config at install time so the restriction survives refresh and unpublish; the publisher and admins are exempt via a live lookup
• guard skill detail/create/update/delete/import endpoints, raw workspace file/doc endpoints, and whole-workspace archive I/O with a 403 SKILL_DETAILS_PROTECTED error; hide skills/ from the published expert preview for non-publishers
• migration 007 adds published_experts.allow_skill_details (SQLite + PostgreSQL)
• dashboard: publish drawer toggle, lock badges on protected skills, blocked edit/delete actions, published-card hint, zh/en locales

Summary

发布专家模板时新增「允许查看技能详情」开关（allow_skill_details，默认开启）。关闭后，安装该专家的用户只能使用其中的各项技能，无法查看或修改技能内容；发布者本人与管理员不受限制。

实现要点：

安装时落限制：安装专家时将 skill_details_restricted + protected_skills 写入 agent config，专家刷新/取消发布后限制依然生效；发布者与管理员豁免通过实时查库判断（若专家已取消发布，豁免随之失效，config 为最终依据）
服务端全链路拦截（403 SKILL_DETAILS_PROTECTED，新增错误码）：
技能详情 / 新建 / 更新 / 删除、URL / 压缩包 / 技能库导入
工作区原始文件读写 / 移动 / 删除 / 上传 / 下载、文档读写、glob、整库 zip 导入导出中对 skills/ 的访问
已发布专家详情预览接口对非发布者隐藏 skills/ 文件
数据库迁移 007：published_experts.allow_skill_details（SQLite + PostgreSQL，含遗留 schema 幂等修复）；发布 / 刷新接口支持设置与切换该开关
前端：发布抽屉开关、受保护技能 🔒 标记、编辑 / 删除入口拦截、已发布卡片提示、中英文文案及 apiErrors 映射

Target branch

• Base is develop (feature / fix — default)
• Base is main (release/* or hotfix/* only)

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation
• Refactor / chore
• Release / hotfix

Test plan

• make all passes locally
• Added/updated tests

Checklist

• Updated CHANGELOG.md (if user-facing)
• README / docs updated (if needed)