fix(commands): honor PILOT_HOME for user command paths

[MicroMilo]

Summary

• resolve user command and skill roots from PILOT_HOME in the commands route
• apply the same active-home roots when listing, loading, and executing user commands/skills
• add a regression test with separate HOME and PILOT_HOME directories

Fixes #344.

Root cause

/api/commands/list imported resolvePilotHome, but still scanned user command and skill directories from os.homedir()/.pilotdeck. That made the command menu diverge from SkillManager and /api/skills/* when PILOT_HOME was set.

The same path assumption also affected the follow-up load/execute path checks, so this PR keeps those handlers on the same active-home roots.

Validation

• npm --workspace ui exec vitest run server/routes/commands.test.js
• npm exec -- tsc --noEmit -p tsconfig.json