Activate Skill Endpoint

Toggle the caller's activation of a skill (turn it on or off).

{"active": true} enables the skill for the authenticated caller (an idempotent upsert); {"active": false} disables it (an idempotent delete). The user is always the authenticated caller, never client-supplied.

Authorization is view-only: the caller must be able to view the skill (owned or shared into their scope). get_skill_metadata enforces that and yields the skill for the response — a caller who cannot view it gets the existing 404 skill_not_found path (no existence leak). A viewer may always toggle their own activation; the owner may disable their own skill.