SkillMD API reachability validation

Description

The pitch.

## Summary

This Phase 1 warm-up improves the SkillMD submission API so programmatic submissions get the same basic safety and reachability behavior as the form path.

## What changed

- Reject non-HTTP(S) `source_url` values for `url` and `github` submissions.
- Add a best-effort 5 second reachability check for API-created hosted SkillMD links.
- Persist the resulting `reachable` value instead of leaving API submissions with an unknown badge state.

## Why

NandaHack explicitly encourages agents and scripts to submit SkillMD records through `POST /api/skills`. Without URL validation and reachability checking, API-created entries can look recorded while still lacking the `link responded` signal that judges and participants use to verify a service can be reached.

## Verification

```bash
cd apps/nest-dashboard
npm ci --ignore-scripts
npm run lint -- src/app/api/skills/route.ts
npx tsc --noEmit
```