feat(frontend): multi-source skill picker (Skill Hub + local upload + validation)

[richarddancin]

… AgentKit SkillSpaces)

Adds three skill sources to the custom agent-creation wizard's skill step.

• Skill Hub (existing public marketplace at skills.volces.com/findskill.com): unchanged behavior, just extracted into its own tab.
• Local files (new): upload a folder or .zip from the browser. Each skill directory must contain a SKILL.md with name (kebab-case, <=64 chars) and description (<=1024 chars, no XML tags); quoted frontmatter values are accepted and stripped; zip-slip paths are rejected. Files are embedded directly in the generated project under skills//.
• AgentKit SkillSpaces (new): browse account-scoped SkillSpaces (ss-) and the skills inside them. Backend adds three SSO-gated /web/skill-spaces routes that call AgentkitSkillsClient with the server's Volcengine credentials (env -> IAM file chain, including VOLCENGINE_SESSION_TOKEN for STS). The browser never sees AK/SK. v1 materializes the SKILL.md (SkillMd) for each selected skill; full TOS-zip download of scripts/assets is a follow-up.

Wiring:

• frontend/src/create/skills.ts refactored into skills/ module (types, zip, skillhub, local, skillspace, barrel).
• SkillsSourceTabs replaces the single picker; shared source-badged pill list.
• codegen emits a SkillToolset loading every selected skill via load_skill_from_dir (one per line for readability); skills are added to Agent(tools=[...]).
• configYaml + normalizeDraft round-trip the new SelectedSkill shape; old {slug,name,namespace}-only YAMLs default to source='skillhub' for backward compat.
• finish() dispatches per-source (local uses embedded files, hub downloads, skillspace fetches SKILL.md); dedup key is source-aware.