fix(skills): the shadowed badge names its sources, not "[object Object]" (#3135)

[dolho]

Summary

• Library → Skills: hovering a card's shadowed badge read "Shadowed by: [object Object]", because shadowed_by is a list of {source_id, source_name} objects (db_models.SkillInfo.shadowed_by) and the tooltip joined the objects themselves.
• It now names each shadowing source, e.g. "Shadowed by: Team catalog, Vendor pack". It falls back to source_id when a name is missing, so it never reads "undefined". This matches LibrarySkillSets.vue and the MCP skills tool.
• The badge gains data-testid="skill-shadowed-library-<name>", following the deprecated badge next to it.

Changes

• src/frontend/src/components/LibrarySkillsSection.vue: the tooltip maps source_name (fallback source_id), plus the test id
• src/frontend/tests/unit/librarySkillShadowedTooltip.mount.spec.js (new, mounted, Safety-critical UI logic keeps landing in the one tier with no executable coverage — and the stated reason is false #2918)

Test Plan

• npx vitest run tests/unit/librarySkillShadowedTooltip.mount.spec.js: 3 passed. It checks that:
  • both sources are named, in order;
  • the id fallback is used, never [object Object] or undefined;
  • an unshadowed skill has no badge.
• On the unfixed component, 2 of the 3 fail ([object Object]).
• Full frontend suite: 245 files, 4,497 tests. check-design-tokens: OK. npm run build: OK.

Fixes #3135

🤖 Generated with Claude Code

[dolho]

/review report: fix/3135-shadowed-tooltip-names → dev

Files changed: 2 (+89/-1). Scope: CLEAN. Plan completion: 2/2:

• the tooltip names each source by source_name;
• a mounted test exists.

Execution coverage

changed symbol	executed by	live consumer	verdict
LibrarySkillsSection.vue shadowed :title	librarySkillShadowedTooltip.mount.spec.js	Library → Skills card	✅

Fix mutation: on the unfixed component, 2 of 3 tests are red ([object Object]).

Live check (local dev stack, 2026-10-01, dev + this PR, light and dark)

The instance's library isn't synced, so /api/skills/library was stubbed in the browser with a skill shadowed by two sources; the page itself was real. The badge title read "Shadowed by: Team catalog, Vendor pack" in both themes.

Critical findings

None.

Informational

• [I1] Consistency: LibrarySkillSets.vue:54 maps source_name without the source_id fallback (confidence 6/10). A nameless source would read "undefined" there. A one-line follow-up, out of this issue's scope.

Clean categories

• XSS: the attribute binding is auto-escaped.
• MCP surface: already maps source_name.

Summary: Critical 0 · Informational 1 · Scope clean.

[vybe]

merge-train: batch validated on train #3172