fix(catalog): bound submissions and commit history atomically

Description

The pitch.

## Summary

- Bound streamed JSON request bodies and individual catalog fields before any database work, with shared validation for the API and submission form.
- Commit a new catalog entry and its history atomically using the existing Neon transaction API; a history failure cannot leave a partial write.
- Preserve the no-fetch boundary for URL/GitHub entries and the existing complete-response listing API.

## Scope and limits

This fixes the current catalog boundary, not skill installation, authorization, verification or agent execution. Global pagination, admission/rate policy and production database limits remain separate decisions. Tests use a stateful transaction fake; no live Neon database or production catalog was modified.

## Verification

Base: `53178b9c780d7a7dd6ce723131c4250de03908dd` (fresh `origin/main`).

On this standalone branch, Node 22.23.2:
- `npm ci --ignore-scripts --no-audit --no-fund`
- `npm test` — 66 passed.
- `npm run typecheck` — passed.
- `git diff --check` — clean.

Regressions were observed failing before the fixes. Independent review checked request bounds, private/public fields, no-fetch behavior and rollback. Combined remediation validation separately passed 71 dashboard tests, typecheck, lint and production build. The current-manual PR introduces the lint/build CI gates; this PR does not suppress existing lint errors.