Add DELETE endpoint for company skills and fix skills.sh URL resolution

- Add DELETE /api/companies/:companyId/skills/:skillId endpoint with same
  permission model as other skill mutations. Deleting a skill removes it
  from the DB, cleans up materialized runtime files, and automatically
  strips it from any agent desiredSkills that reference it.
- Fix parseSkillImportSourceInput to detect skills.sh URLs
  (e.g. https://skills.sh/org/repo/skill) and resolve them to the
  underlying GitHub repo + skill slug, instead of fetching the HTML page.
- Add tests for skills.sh URL resolution with and without skill slug.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/company-skills.ts

@@ -221,6 +221,35 @@ export function companySkillRoutes(db: Db) {
     },
   );
 
+  router.delete("/companies/:companyId/skills/:skillId", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const skillId = req.params.skillId as string;
+    await assertCanMutateCompanySkills(req, companyId);
+    const result = await svc.deleteSkill(companyId, skillId);
+    if (!result) {
+      res.status(404).json({ error: "Skill not found" });
+      return;
+    }
+
+    const actor = getActorInfo(req);
+    await logActivity(db, {
+      companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      action: "company.skill_deleted",
+      entityType: "company_skill",
+      entityId: result.id,
+      details: {
+        slug: result.slug,
+        name: result.name,
+      },
+    });
+
+    res.json(result);
+  });
+
   router.post("/companies/:companyId/skills/:skillId/install-update", async (req, res) => {
     const companyId = req.params.companyId as string;
     const skillId = req.params.skillId as string;