security: harden refresh-skills endpoint and add skills docs security gate

.github/workflows/ci.yml

@@ -110,6 +110,9 @@ jobs:
           ENABLE_NETWORK_TESTS: "1"
         run: npm run test
 
+      - name: Run docs security checks
+        run: npm run security:docs
+
   artifact-preview:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
@@ -220,6 +223,9 @@ jobs:
           ENABLE_NETWORK_TESTS: "1"
         run: npm run test
 
+      - name: Run docs security checks
+        run: npm run security:docs
+
       - name: Build catalog
         run: npm run catalog