feat(hub): built-in PBank 题库 capability + role tools (v0.0.42)

Register pbank as an ADR-0027 external capability with org-scoped
username/password envelopes, readiness via /login, and in-process
cph_hub MCP tools (search/get/get_many) that materialize sources under
the run workspace. Extend the capability secret payload for docmind vs
pbank kinds, admin capabilities UI, role tool umbrella `pbank`, and the
pbank-problem-report skill. Credentials never reach the Agent process.

hub/admin-web/src/lib/api.ts

@@ -480,7 +480,18 @@ export const api = {
 	rotateCapabilityConnection: (
 		slug: string,
 		capabilityId: string,
-		body: { accessKeyId: string; accessKeySecret: string; endpoint: string },
+		body:
+			| { kind?: 'docmind'; accessKeyId: string; accessKeySecret: string; endpoint: string }
+			| {
+					kind: 'pbank';
+					baseUrl: string;
+					username: string;
+					password: string;
+					rightsStatus?: string;
+					rightsHolder?: string;
+					rightsScope?: string;
+					rightsNote?: string;
+			  },
 	) =>
 		put(`${orgBase(slug)}/capability-connections/${encodeURIComponent(capabilityId)}`, body) as Promise<CapabilityConnection>,
 	disableCapabilityConnection: (slug: string, capabilityId: string) =>