Merge origin/main into sources-projects

Pulls in 7 new commits from main:
- #8932 break up acp/server.rs into submodules
- #8924 custom providers UI/ACP
- #8935 keep renamed skills open in detail view
- #8897 skill refactor (CreateSkillDialog -> SkillEditor)
- #8886 copy/content polish
- #8905 Gemini OAuth fix
- #8546 command injection patterns

Conflicts resolved:
- crates/goose/src/acp/server.rs: took main's split structure;
  added project-related plumbing (properties, project_id,
  include_project_sources) into crates/goose/src/acp/server/sources.rs.
- update_thread_metadata: pub(super) so server/sessions.rs (which
  hosts on_update_session_project) can call it.
- ui/goose2/src/features/skills/api/skills.ts: dropped
  directoryPath/editable (not on main's SkillInfo); kept our
  projectName/projectDir lookup from backend properties.
- ui/goose2/src/features/skills/ui/SkillEditor.tsx (renamed from
  CreateSkillDialog.tsx in #8897): kept main's structure; re-added
  our save-location picker (Global vs each project) and onSaved
  callback.
- ui/goose2/src/shared/i18n/locales/en/skills.json: took main's
  casing for editTitle/newTitle; kept our new keys (global,
  globalHint, projectHint, saveLocation).

Bumped useChatSessionController.ts file-size limit by 10 lines
(840 -> 850); justification updated to mention ACP project sync.

Author: Douwe Osinga

.agents/skills/ui-refactor-review/SKILL.md

@@ -2093,7 +2093,7 @@ fn add_provider() -> anyhow::Result<()> {
         engine: provider_type.to_string(),
         display_name: display_name.clone(),
         api_url,
-        api_key,
+        api_key: requires_auth.then_some(api_key),
         models,
         supports_streaming: Some(supports_streaming),
         headers,