feat(cloud): skill management + host-scoped sync REST endpoints

Adds the skills:admin router (cloud/sdk/skill_api.py) for cloud-skill CRUD
and per-host entitlement grant/revoke with CSRF/scope/audit, and a
host-scoped router serving incremental per-host sync deltas plus the
agent local-skill inventory report/readback. Both composed into the
Cloud API app. cloud-api suite green (46 passed).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/cloud-api/cloud_api/app.py

@@ -32,6 +32,7 @@ from cloud.control_config import (
 from cloud.database import CloudDatabase
 from cloud.internal_api.api import create_internal_router
 from cloud.llm_providers import LlmProviderService
+from cloud.skills import CloudSkillService
 from cloud.plugins import PluginRegistry
 from cloud.observability import (
     CORRELATION_HEADER,
@@ -46,6 +47,7 @@ from cloud.schema import require_current_schema
 from cloud.sdk.api import create_cloud_router
 from cloud.sdk.governance_api import create_governance_router
 from cloud.sdk.llm_provider_api import create_llm_provider_router
+from cloud.sdk.skill_api import create_skill_host_router, create_skill_management_router
 from cloud.sdk.user_api import create_user_auth_router
 from cloud.user_auth import USER_CSRF_COOKIE, USER_SESSION_COOKIE, UserAuthService, UserAuthSettings
 from core.models import utc_now
@@ -130,6 +132,7 @@ def create_app(
         ),
     )
     llm_provider_service = LlmProviderService(repository)
+    cloud_skill_service = CloudSkillService(repository)
     auth_provider = ChainedAuthProvider(
         (
             configured_auth_provider,
@@ -325,6 +328,24 @@ def create_app(
             ),
         )
     )
+    app.include_router(
+        create_skill_management_router(
+            service=cloud_skill_service,
+            repository=repository,
+            auth_provider=auth_provider,
+            csrf_validator=lambda request, principal: _valid_csrf_request(
+                request,
+                principal,
+                user_auth_service,
+            ),
+        )
+    )
+    app.include_router(
+        create_skill_host_router(
+            service=cloud_skill_service,
+            auth_provider=auth_provider,
+        )
+    )
     app.include_router(
         create_internal_router(
             pool=pool,