feat(hub): built-in PBank 题库 capability + role tools (v0.0.42)

Register pbank as an ADR-0027 external capability with org-scoped
username/password envelopes, readiness via /login, and in-process
cph_hub MCP tools (search/get/get_many) that materialize sources under
the run workspace. Extend the capability secret payload for docmind vs
pbank kinds, admin capabilities UI, role tool umbrella `pbank`, and the
pbank-problem-report skill. Credentials never reach the Agent process.

hub/test/integration/capability-pdf-to-md.test.ts

@@ -58,6 +58,7 @@ describe("pdf_to_md_bundle capability adapter (ADR-0027)", () => {
   async function seedActiveCapabilityConnection(): Promise<void> {
     const payload: CapabilitySecretPayload = {
       schemaVersion: 1,
+      kind: "docmind",
       accessKeyId: "LTAI-test-key-id",
       accessKeySecret: "test-secret-never-log",
       endpoint: "docmind-api.cn-hangzhou.aliyuncs.com",