fix: repair skill zip download and YAML frontmatter

[whipser030]

Summary

• Download skill ZIPs through the authenticated API client so browser downloads include the required API key.
• Emit ZIP archives with stored payloads, current timestamps, Unix file attrs, and a package folder containing SKILL.md for more reliable decompression.
• Render downloaded SKILL.md files with YAML frontmatter (name, description) for external agent compatibility.

Test plan

• npm test -- --run tests/unit/storage/tiny-zip.test.ts tests/unit/server/http.test.ts

Made with Cursor