feat(cli,api): add skillx publish command with auth and ownership validation

[mrgoonie]

Summary

• Add skillx publish CLI command with git remote auto-detect, --path, --scan, --dry-run options
• Secure Register API (POST /api/skills/register) with authentication (API key or session)
• Validate GitHub repo ownership via collaborator permission API (require write access)
• Add path traversal protection on skill_path input
• Handle GitHub token expiry with clear error messages
• Create shared authenticate-request.ts helper (reusable across routes)
• Archive 3 completed/draft plans to plans/archived/
• Update codebase-summary and system-architecture docs

New files

File	Purpose
apps/web/app/lib/auth/authenticate-request.ts	Shared auth: API key + session fallback
apps/web/app/lib/github/validate-repo-ownership.ts	GitHub permission check (write access required)
packages/cli/src/commands/publish.ts	CLI skillx publish command

Test plan

• skillx publish without API key shows error with setup instructions
• skillx publish with invalid API key returns 401
• skillx publish owner/repo where user lacks access returns 403
• skillx publish owner/repo where user has write access succeeds
• skillx publish --dry-run shows preview without calling API
• skillx publish in a git repo auto-detects owner/repo from remote
• skillx publish --scan discovers all SKILL.md files in repo
• Path traversal attempt (--path ../../etc) returns 400