feat(hub): add markdown_to_pdf tool and default web tools

Teachers need ad-hoc Markdown → PDF. Ship an MCP tool powered by
md-to-pdf (Marked + headless Chrome) so remote images/CSS work, with
workspace-scoped basedir, front-matter stripped so untrusted markdown
cannot override dest/basedir/launch options, and MathJax for $/$ math.

Also include WebFetch and WebSearch in the unrestricted role tool
surface by default. Deploy skips Puppeteer's browser download and
expects a host Chrome/Chromium (PUPPETEER_EXECUTABLE_PATH / CHROME_PATH).

hub/src/feishu/card/builder.ts

@@ -42,6 +42,9 @@ const TOOL_ICONS: Record<string, string> = {
   request_approval: "thumb-up-filled",
   feishu_read_context: "search-filled",
   feishu_download_resource: "download-filled",
+  markdown_to_pdf: "file-link-excel-filled",
+  webfetch: "link-copy-filled",
+  websearch: "search-filled",
 };
 
 function toolIcon(toolName: string): string {