Add community node protocol spec, Agent Skills, and make the failing tests hermetic

Community nodes (Phase 1 of plan.md): the protocol specification in
services/nodes/spec.py as the single source of truth, GET /nodes/spec.json,
a generated protocol docs page, the Community nodes API docs group, and the
implementation plan plus the residential proxy research. The no-open-proxy rule
is enforced in the spec (open_proxy cannot be set).

Agent Skills: register the Skills API docs group, cascade skills on account
deletion, add the nested CLAUDE.md, README and routes docs, and cover the
parser, the fetcher (end to end against a mock origin), the data layer and the
routes with 73 unit and 16 api tests.

Tests made hermetic with the repo's existing patterns instead of ambient
environment: embeddings tests set OPENROUTER_API_KEY via monkeypatch, the
workspace tests install FakeBackend via runtime.set_backend, and the skills
install tests use run_async. DockerCliBackend now returns 127 (command not
found) when the CLI is missing instead of raising FileNotFoundError, so a host
without docker answers with a clean error rather than a 500. The Providers tab
empty state no longer names the Model routes tab.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/api/admin/gateway/providers.py

@@ -194,3 +194,34 @@ def test_provider_edit_page_404_for_missing_provider(seeded_db):
         admin.post(f"{BASE_URL}/admin/gateway/providers/{missing}/delete").status_code
         == 404
     )
+
+
+def test_provider_protocol_round_trip(seeded_db):
+    admin = admin_session(seeded_db)
+    name = _unique_gateway("protop").lower()
+
+    created = admin.post(
+        f"{BASE_URL}/admin/gateway/providers",
+        json={
+            "name": name,
+            "base_url": "https://api.meta.ai/v1/responses",
+            "api_key": "sk-test",
+            "is_active": True,
+            "protocol": "responses",
+        },
+    )
+    assert created.status_code == 200, created.text[:300]
+    assert created.json()["provider"]["protocol"] == "responses"
+
+    listed = admin.get(f"{BASE_URL}/admin/gateway/providers").json()
+    match = next((p for p in listed["providers"] if p["name"] == name), None)
+    assert match is not None
+    assert match["protocol"] == "responses"
+
+    bad = admin.post(
+        f"{BASE_URL}/admin/gateway/providers",
+        json={"name": _unique_gateway("protobad").lower(), "protocol": "soap"},
+    )
+    assert bad.status_code in (400, 422)
+
+    assert admin.delete(f"{BASE_URL}/admin/gateway/providers/{name}").status_code == 200