refactor: extract shared AI runner

[aksOps]

Summary

• move the skill runner, board tools, built-in skills, guarded link client, and tool-calling probe into internal/ai
• expose a direct-store runner and tool constructors for local TUI and CLI callers
• leave the server as a thin adapter that preserves the existing HTTP request and response contracts
• move the tool and skill tests with the implementation and add direct runner, probe, and guard coverage

Why

The server owned AI infrastructure that did not depend on HTTP. Local frontends would otherwise need to construct a server merely to run a skill against *store.Store, which is architecture by hostage situation.

Validation

• env GOFLAGS=-buildvcs=false sh scripts/check-go-coverage.sh (96.8% total; internal/ai 95.5%; internal/server 98.2%)
• env GOFLAGS=-buildvcs=false go vet ./...
• env GOFLAGS=-buildvcs=false go test -race ./... -count=1
• npm test (60 files, 695 tests)
• npm run build
• sh scripts/check-go-format.sh
• git diff --check

Closes #81

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
96.7% Coverage on New Code
1.6% Duplication on New Code

See analysis details on SonarQube Cloud