feat(21st): replace the magic MCP with the @21st-dev CLI + skill pack

Upstream supersedes `@21st-dev/magic` with `@21st-dev/cli` (bin `21st`):
same endpoint, `21st login` in place of an API key, no MCP process loaded
into every session.

- install-plugins.sh Step 8.7: `npm i -g @21st-dev/cli` (pinned in
  plugins.lock.json), staged `21st skills install`, TTY-only login offer,
  pack disabled by default. update-all.sh 7.4 refreshes both.
- The documented `21st install-skill` cannot be used: the installer refuses
  to follow a symlink on the target path and `~/.claude/skills` is one. The
  install runs under a throwaway HOME and the result moves into
  skills-external/21st-* (gitignored), symlinked on demand.
- toggle-external.sh manages `21st` as a pack (names globbed from
  skills-external/21st-*, parked under plain names). `magic` is gone.
- The 5 design skills join design/web/web-full/full and MANAGED_EXTERNALS;
  21st-registry and 21st-design-sync stay parked. MANAGED_MCPS is now empty
  and profile.sh's dead magic branches are removed.
- Design gate: GATE-BLOCK gains `21st` (required-manual, magic's old slot)
  and `21st-ui-build`; PATH repair extended to the npm global bin.
- settings.json: the 4 mcp__magic__* ask entries go; the outward-facing
  21st verbs land in autoMode.soft_deny, the tier that holds under auto
  mode (LRN-153).
- Docs: README, CLAUDE.global.md, design-gate.md, profile SKILL.md,
  .env.example, .gitleaks.toml, link.sh. BDR-093, LRN-158.

Tests: profile-set-managed 17/17, make test green except 2 pre-existing
gitflow FAILs (gitleaks binary absent on this host), shellcheck clean.

.gitleaks.toml

@@ -67,8 +67,9 @@ regexTarget = "line"
 regexes = [
   '''X-Amz-Credential=AKIA[0-9A-Z]{16}''',
   '''private-user-images\.githubusercontent\.com/[^"]*\?jwt=''',
-  '''MAGIC_API_KEY=abc123''',
-  # magic MCP docs example — base64 of "the ..." ASCII sample text.
+  # Docs/test example — base64 of the "the ..." ASCII sample text, never a key.
+  # (The MAGIC_API_KEY=abc123 placeholder that sat here went with the magic
+  # MCP, removed 2026-09-22 when 21st.dev moved to a CLI with no API key.)
   '''clientKey = 'dGhlIH[A-Za-z0-9+/=]*'''',
 ]