feat(appkit): add AI Functions beta plugin

[philip]

Summary

Adds a beta plugin for Databricks AI Functions
(ai-classify, ai-extract, ai-decide), which turn text into labels,
extracted fields, or answers to questions, returned as JSON.

An app defines each job once as a named task, then calls it from React
(useAiFunction), from server code (run), or as an agent tool
(<task>.invoke). The browser sends only the text, so users can't change
the prompt, and results are typed from the task definition.

ai-parse-document is left for a follow-up. It takes a Unity Catalog
volume path rather than the document itself, so it likely fits best
alongside the files plugin.

Design notes

• Tasks: plain JSON, typed with as const satisfies AiFunctionTasks,
  validated at startup. POST /api/ai-functions/:task/invoke accepts
  exactly { content } or { state }. The client config exposes only each
  task's name and function.
• Identity: per-task auth ("service-principal" by default, or
  "on-behalf-of-user"), matching AI Search and Files. User-task routes use
  _asUserScoped(req). A service-principal task runs as the app, but never
  widens an on-behalf-of-user agent run or runAgent({ caller }); there it
  runs as the user. A user task's 401 becomes IDENTITY_EXPIRED.
• Scopes: the manifest declares scopes: ["ai-functions"], and
  ai-functions is added to the shared capability scopes.
  template/databricks.yml.tmpl is unchanged.
• Errors: an AppKitError with statusCode and isRetryable. No
  plugin-specific error class is exported. The upstream 400 detail is
  returned to the caller but kept out of spans and logs.
• Public surface: curated beta exports: the task and request/response
  types, plus extractValues, citedText, and scoreLevel. appkit-ui adds
  useAiFunction.

Testing

• Unit: 229 tests across the plugin, connector, hook, helpers, and the
  route deprecation check. These include identity-scope tests,
  cancel-vs-timeout race tests, and hook-state tests. Full suite: 5,771
  passed.
• CI, run locally: every job in ci.yml (lint, typecheck, knip,
  licenses, generated files, template sync, unit, Playwright integration,
  and template smoke for pnpm and npm).
• Live, against a staging workspace:
  • every example in the plugin doc (44 checks);
  • agent tools in mixed and on-behalf-of-user agents;
  • two apps deployed from this branch, exercising service-principal and
    on-behalf-of-user task routes.

Notes for reviewers

• ai-decide is in beta on Databricks and may need enabling from the
  workspace Previews page.
• Unrelated, pre-existing: custom-plugins.md links to
  execution-context.md#telemetry-span-attributes, a heading the recent
  identity rewrite removed. The docs build warns about it.

This pull request and its description were written by Isaac.