feat(hub): built-in PBank 题库 capability + role tools (v0.0.42)

Register pbank as an ADR-0027 external capability with org-scoped
username/password envelopes, readiness via /login, and in-process
cph_hub MCP tools (search/get/get_many) that materialize sources under
the run workspace. Extend the capability secret payload for docmind vs
pbank kinds, admin capabilities UI, role tool umbrella `pbank`, and the
pbank-problem-report skill. Credentials never reach the Agent process.

hub/src/capability/pdfToMdBundle.ts

@@ -23,6 +23,7 @@ import { resolveCapabilityCredential } from "./capabilityConnections.js";
 import { DocmindClientError, type CapabilityProviderClient } from "./docmindClient.js";
 import {
   CAPABILITIES,
+  asDocmindSecret,
   type CapabilityAdapter,
   type CapabilityInvocationInput,
   type CapabilityInvocationResult,
@@ -212,7 +213,7 @@ export function createPdfToMdBundleAdapter(deps: PdfToMdBundleDeps): CapabilityA
       // 3. Call the backing service.
       let result;
       try {
-        result = await deps.client.parse(credential, { inputFilePath: absoluteInput });
+        result = await deps.client.parse(asDocmindSecret(credential), { inputFilePath: absoluteInput });
       } catch (e) {
         if (e instanceof DocmindClientError) throw e;
         throw new DocmindClientError(