feat: the A2UI card catalog lives in a directory #85

Is your feature request related to a problem?

Every A2UI card was declared in src/assistant/a2ui.py — a single 843-line file carrying ~25 component schemas. Adding a card meant editing that file and shipping a release; a user could not add one at all, and a plugin (#75) had nothing to install.

Describe the solution you'd like

Every card is a file in a directory, carrying both halves of the card: the field schema the model fills in and the layout composed from primitives. The directory follows the skills layering (ADR 0016) — Bundled, Global, Profile — with disable and per-profile suppression on the same semantics.

Status — implemented in #117 (in review)

• Format (src/assistant/cards/, ADR 0036): one *.card.yaml per Card — name (its identity; the filename is free), description (the "Use when…" line), optional topic, fields, layout, example. A file that fails to load, busts a size budget or reuses a name already taken in its layer is skipped with a warning.
• Layers: Bundled src/assistant/cards/bundled/, Global <root>/cards/, Profile workspace/cards/ (inside the profile's Files space); Profile over Global over Bundled by name.
• Look is data (ADR 0037): a layout draws only from the Basic-catalog primitives plus a small app vocabulary (VOCABULARY.md: Table, Metric, Sparkline, WeatherGlyph, Link, …). The server expands each instance into primitives, so no Card has a bespoke Svelte renderer any more — the earlier plan to keep first-party renderers was dropped; all twelve Cards are files drawn by one generic renderer.
• Switches: cards.json at the root — install-wide Disable, per-profile Suppression, default-on.
• Disclosure (ADRs 0038, 0039): the bundled rich-views Skill; its description names each available Card's topic, its body is the index, one Card's schema and example is a resource.

Left for follow-ups: editing and a Settings page (#87), the delete cascade that clears a removed Card's switches (built, not yet called — #87), and applying a Card change without a profile reload (#121).

Alternatives considered

• Schema only, layout stays in the front end — rejected: a user-authored card would have no way to look like anything.
• Let a card file carry its own renderer code (JS/HTML/CSS) — rejected: that is executing third-party code in the UI and needs its own security conversation.

See also: #75 — plugins should be able to carry cards, into the same layer they install skills into.