feat(21st): replace the magic MCP with the @21st-dev CLI + skill pack

Upstream supersedes `@21st-dev/magic` with `@21st-dev/cli` (bin `21st`):
same endpoint, `21st login` in place of an API key, no MCP process loaded
into every session.

- install-plugins.sh Step 8.7: `npm i -g @21st-dev/cli` (pinned in
  plugins.lock.json), staged `21st skills install`, TTY-only login offer,
  pack disabled by default. update-all.sh 7.4 refreshes both.
- The documented `21st install-skill` cannot be used: the installer refuses
  to follow a symlink on the target path and `~/.claude/skills` is one. The
  install runs under a throwaway HOME and the result moves into
  skills-external/21st-* (gitignored), symlinked on demand.
- toggle-external.sh manages `21st` as a pack (names globbed from
  skills-external/21st-*, parked under plain names). `magic` is gone.
- The 5 design skills join design/web/web-full/full and MANAGED_EXTERNALS;
  21st-registry and 21st-design-sync stay parked. MANAGED_MCPS is now empty
  and profile.sh's dead magic branches are removed.
- Design gate: GATE-BLOCK gains `21st` (required-manual, magic's old slot)
  and `21st-ui-build`; PATH repair extended to the npm global bin.
- settings.json: the 4 mcp__magic__* ask entries go; the outward-facing
  21st verbs land in autoMode.soft_deny, the tier that holds under auto
  mode (LRN-153).
- Docs: README, CLAUDE.global.md, design-gate.md, profile SKILL.md,
  .env.example, .gitleaks.toml, link.sh. BDR-093, LRN-158.

Tests: profile-set-managed 17/17, make test green except 2 pre-existing
gitflow FAILs (gitleaks binary absent on this host), shellcheck clean.

.gitignore

@@ -69,6 +69,12 @@ skills/impeccable
 # External skills installed via `npx skills add` — auto-created by link.sh
 skills/darwin-skill
 
+# 21st.dev skill pack symlinks — created on demand by toggle-external.sh /
+# profile.sh (the pack is DISABLED by default, so these usually don't exist).
+# A glob, not one line per skill: the `21st skills install` manifest owns the
+# membership, so the pack can gain a skill with no edit here.
+skills/21st-*
+
 # Context7 docs-lookup skill — installed by `ctx7 setup --claude --cli`
 # (install-plugins.sh Step 6, when absent) into ~/.claude/skills (a symlink to
 # this repo's skills/). ctx7-managed and re-created on demand — not vendored here.
@@ -156,6 +162,13 @@ skills-external/frontend-design/
 # an edit. The source is always re-fetched, so no offline copy is needed.
 skills-external/emil-design-eng/
 
+# 21st.dev skill pack — machine-owned: `21st skills install` output, staged by
+# install-plugins.sh Step 8.7 (the installer refuses to write through the
+# ~/.claude/skills symlink, so it runs under a throwaway HOME and the skills
+# are moved here). Refreshed by update-all.sh. Not vendored: the CLI owns the
+# layout and the content is sha256-verified against 21st.dev's manifest.
+skills-external/21st-*/
+
 # Impeccable — machine-owned dist produced by `npx impeccable skills install`
 # (install-plugins.sh Step 8d, update-all.sh), pinned in plugins.lock.json.
 # Not vendored: the installer owns the layout and rewrites it on update