Install a missing provider CLI with one click - #121

A provider whose CLI is absent now carries an install capability when npm
resolves on the server: `npm install -g <pkg>@latest`, the same command
family updates use, run through the same maintenance runner (shared
npm-global lock, output capture, updateState progress, post-command
re-probe). Verification differs by intent: an install must leave the
provider detectable, an update must leave it current; either shortfall
reports as unchanged with a plain explanation.

The settings card shows Install in its header action group with running
and failure states; the first-run setup card upgrades its Install guide
action to Install when the capability exists. Both render from streamed
snapshots. A configured NPM_CONFIG_PREFIX is honored end to end (baked
into the command's environment patch and display string), and with npm
absent everything falls back to the linkified guide.

Contracts: versionAdvisory gains installCommand/canInstall with decoding
defaults for older snapshot caches; server.updateProvider gains an
action field instead of a new RPC.

The create-folder palette test (issue #117) flaked because the click
helper fired a synthetic click on the first DOM node matching the row
label. During a palette view transition an exit-animating copy of the
row can still be in the DOM with its React handlers gone, and a
synthetic click on it is silently lost; a real pointer cannot make that
mistake. The helper now emulates hit-testing and clicks the candidate
that owns the pixels at its own center.