feat(hub): add markdown_to_pdf tool and default web tools

Teachers need ad-hoc Markdown → PDF. Ship an MCP tool powered by
md-to-pdf (Marked + headless Chrome) so remote images/CSS work, with
workspace-scoped basedir, front-matter stripped so untrusted markdown
cannot override dest/basedir/launch options, and MathJax for $/$ math.

Also include WebFetch and WebSearch in the unrestricted role tool
surface by default. Deploy skips Puppeteer's browser download and
expects a host Chrome/Chromium (PUPPETEER_EXECUTABLE_PATH / CHROME_PATH).

hub/package.json

@@ -14,6 +14,7 @@
     "ai": "^7.0.16",
     "dotenv": "^17.4.2",
     "fastify": "^5.8.5",
+    "md-to-pdf": "^5.2.5",
     "zod": "^4.4.3"
   },
   "devDependencies": {