feat(skills): add api-design skill and plugin manifest

[h30s]

Closes #9

Summary

Adds the api-design skill to review public interfaces (HTTP/REST endpoints, GraphQL schemas, RPC methods, SDK functions, and exported module types) before they become expensive breaking changes after release.

PR Requirements Checklist (per CONTRIBUTING.md)

1. Task Tested & Before vs. After

• Task: Reviewing a newly added POST /api/v1/transfers endpoint and a GET /api/v1/transfers list endpoint.

• Before (Default model review):

  • Focused on internal helper style.
  • Suggested generic code comments.
  • Accepted the flat array return.
  • Accepted the lack of idempotency keys without identifying post-release migration costs.

• After (With /api-design):

  • Flagged the omission of an idempotency key mechanism on state mutation, noting that requiring it post-release is a breaking change for client integrations.
  • Flagged the unpaginated array return shape, calculating the post-release cost: wrapping the array in an object envelope breaks JSON deserializers across all clients.
  • Verified caller code in apps/web and services/worker, grounding all findings in concrete caller impact.
  • Explicitly separated contract defects from naming preferences.

2. What was Deliberately Left Out (and Why)

• Internal implementation reviews: Omitted critiques of internal helper functions, local algorithms, and database queries because private implementation can be refactored at any time without breaking downstream callers.

• Speculative protocol additions: Omitted generic suggestions for alternative architectures (e.g. gRPC/WebSockets) to avoid noise and focus strictly on the interface contract at hand.

• Linter/formatting nits: Delegated formatting and syntax styling to automated formatters.

3. Tools Matching

• Configured with tools: chat (read-only) because interface review is a pure evaluation task that does not mutate files or execute commands.