feat(hub): built-in PBank 题库 capability + role tools (v0.0.42)

Register pbank as an ADR-0027 external capability with org-scoped
username/password envelopes, readiness via /login, and in-process
cph_hub MCP tools (search/get/get_many) that materialize sources under
the run workspace. Extend the capability secret payload for docmind vs
pbank kinds, admin capabilities UI, role tool umbrella `pbank`, and the
pbank-problem-report skill. Credentials never reach the Agent process.

hub/src/capability/docmindClient.ts

@@ -21,7 +21,7 @@ import $DocmindClient, {
 import { RuntimeOptions } from "@alicloud/tea-util";
 import { createReadStream } from "node:fs";
 import { basename } from "node:path";
-import type { CapabilitySecretPayload } from "./types.js";
+import type { DocmindCapabilitySecretPayload } from "./types.js";
 
 /** A single extracted image downloaded from the markdown's OSS image URLs. */
 export interface DocmindExtractedImage {
@@ -43,7 +43,7 @@ export interface DocmindParseOptions {
 }
 
 export interface CapabilityProviderClient {
-  parse(credential: CapabilitySecretPayload, options: DocmindParseOptions): Promise<DocmindParseResult>;
+  parse(credential: DocmindCapabilitySecretPayload, options: DocmindParseOptions): Promise<DocmindParseResult>;
 }
 
 export class DocmindClientError extends Error {
@@ -65,7 +65,7 @@ const POLL_TIMEOUT_MS = 5 * 60_000;
 type DocmindConfig = ConstructorParameters<typeof $DocmindClient.default>[0];
 
 export class AliyunDocmindClient implements CapabilityProviderClient {
-  async parse(credential: CapabilitySecretPayload, options: DocmindParseOptions): Promise<DocmindParseResult> {
+  async parse(credential: DocmindCapabilitySecretPayload, options: DocmindParseOptions): Promise<DocmindParseResult> {
     const config: DocmindConfig = {
       endpoint: credential.endpoint,
       accessKeyId: credential.accessKeyId,