feat(skills): durable Cosmos-backed skills + Skill Builder

[bcperry]

Move agent skills off the backend's ephemeral local filesystem (skills/ + SKILL.md) into Azure Cosmos DB as the durable, shared source of truth — mirroring the Cosmos agent-memory (011) and autonomous directive (012) patterns. The skills/ directory now only seeds defaults at startup; Cosmos is the runtime store for every create/edit/delete from the admin Skill Builder. The /api/skills* REST contract and the React frontend are unchanged.

• cosmos_memory: skills live in a new skills container (partition /id). The per-container repos now share a _CosmosContainer base (the database/container bootstrap was copy-pasted across 5 classes), and the two identical /id stores (autonomous directives + skills) collapse into one generic _CosmosByIdRepository (list_all/get/create/upsert/delete) — the per-user analogue of user_data.CosmosUserScopedRepository.
• skills_manager: async Cosmos-backed SkillManager (validation retained) + idempotent seed_skills()/filesystem_skill_docs() (never overwrites edits). The id is the single canonical skill name (no redundant stored name).
• agent_factory: CosmosSkillsSource (lazy async get_skills) via FilteringSkillsSource.
• validators/session_orchestration: available_skill_names() reads from Cosmos.
• main: skill endpoints await the async manager; lifespan seeds skills.
• infra: new skills Cosmos container fully wired (var/output/app setting).
• tests: one InMemoryByIdRepository double backs both stores; new test_skills_cosmos (seeding, durability, emulator repo CRUD); autonomous + skills suites updated to the generic API.

Offline + emulator suites green. No non-durable fallback. Authorization model (authenticated-user, consistent with sibling admin endpoints) documented in spec.