feat: add direct XMemo service client

[yunze7373]

Summary

• Turn xmemo from a configuration-only utility into a direct REST client for Memory, Context, State/Restart, Knowledge, Dream, and Cloud Skill workflows.
• Reuse the existing login/OAuth credential path while enforcing service-origin binding, redirect rejection, safe error classification, bounded local-file reads, and secret-safe output.
• Keep the packaged Codex Skill and its release workflow independent from CLI runtime upgrades.

Contract boundary

• Cloud Skill read/list/run capabilities are implemented against the current service contract.
• Cloud Skill add/update fail closed until the MemoryOS server publishes the required MOS-01 write contract; this PR does not claim that unsupported production capability.
• This feature PR does not bump, tag, release, or deploy the npm package.

Validation

• npm test: 206 passed, 0 failed
• npm run lint: passed
• npm pack --dry-run --json: passed, 88 package entries
• npm audit --omit=dev --json: 0 vulnerabilities
• git diff --check origin/main...HEAD: passed
• DevFlow exact-scope self-review approved under explicit user authorization: request c2b7e3b2-0210-4700-82e3-8950341925d2, commit b95dcc40fb1e9ff6c16eff0d54d102a46c025ea7, 43 files, 0 findings

Review note

The DevFlow decision above records the submitting agent's self-review because the independent Reviewer standby was unavailable for this worktree. It is not represented as an independent reviewer approval.