feat(21st): replace the magic MCP with the @21st-dev CLI + skill pack

Upstream supersedes `@21st-dev/magic` with `@21st-dev/cli` (bin `21st`):
same endpoint, `21st login` in place of an API key, no MCP process loaded
into every session.

- install-plugins.sh Step 8.7: `npm i -g @21st-dev/cli` (pinned in
  plugins.lock.json), staged `21st skills install`, TTY-only login offer,
  pack disabled by default. update-all.sh 7.4 refreshes both.
- The documented `21st install-skill` cannot be used: the installer refuses
  to follow a symlink on the target path and `~/.claude/skills` is one. The
  install runs under a throwaway HOME and the result moves into
  skills-external/21st-* (gitignored), symlinked on demand.
- toggle-external.sh manages `21st` as a pack (names globbed from
  skills-external/21st-*, parked under plain names). `magic` is gone.
- The 5 design skills join design/web/web-full/full and MANAGED_EXTERNALS;
  21st-registry and 21st-design-sync stay parked. MANAGED_MCPS is now empty
  and profile.sh's dead magic branches are removed.
- Design gate: GATE-BLOCK gains `21st` (required-manual, magic's old slot)
  and `21st-ui-build`; PATH repair extended to the npm global bin.
- settings.json: the 4 mcp__magic__* ask entries go; the outward-facing
  21st verbs land in autoMode.soft_deny, the tier that holds under auto
  mode (LRN-153).
- Docs: README, CLAUDE.global.md, design-gate.md, profile SKILL.md,
  .env.example, .gitleaks.toml, link.sh. BDR-093, LRN-158.

Tests: profile-set-managed 17/17, make test green except 2 pre-existing
gitflow FAILs (gitleaks binary absent on this host), shellcheck clean.

CLAUDE.global.md

@@ -290,16 +290,18 @@ OR a design/UI request — not the keyword "design" alone in a prompt. Single
 source for design routing; the design-toolchain hook reinforces it.
 - Trivial (≤2 files, one cosmetic value) → /hotfix, no toolchain.
 - Build UI (component, page, redesign) → ui-ux-pro-max + frontend-design
-  (anti-slop) + Magic MCP /ui + emil-design-eng (polish) +
-  design-motion-principles (if motion) + design-html (if static).
+  (anti-slop) + 21st-ui-build (catalog + generation) + emil-design-eng
+  (polish) + design-motion-principles (if motion) + design-html (if static).
   Post-build floor: `npx impeccable detect <files>` (45 deterministic
   anti-slop rules, exit 2 = findings) when impeccable installed.
 - Design system / brand → design-consultation first, then the build tools.
 - Review / audit → design-review + emil-design-eng + design-motion-principles
-  + /impeccable audit|critique (skill) + `impeccable detect` floor.
+  + 21st-ui-review + /impeccable audit|critique + `impeccable detect` floor.
 Scope doubt → don't silently skip: ask, or default to Build tier.
 Gate: lightweight skills run `~/.claude/lib/design-gate.md`; orchestrators via
-plugin-check. Magic MCP costs API calls — generation, not micro-tweaks.
+plugin-check. 21st = CLI (`npm i -g @21st-dev/cli`, `21st login`), no MCP,
+no API key. Search is free; `21st get` and `21st generate` are metered —
+generation, not micro-tweaks.
 
 ## graphify