feat: add xui-deploy skill with lessons learned

- SKILL.md v1.1: full deployment workflow for 3x-ui on VPS via SSH
- Covers Docker/native install, Nginx+TLS, Xray inbound config
- references/xray-inbound-config.md: VLESS+WS+TLS and Reality configs
- references/lessons-learned.md: lessons from first real deployment
  - /app/x-ui binary vs shell wrapper in Docker
  - correct API path: panel/api/inbounds/add
  - subPath-only DB write (subURI causes blank settings page)
  - --network host port exposure workaround
- Agent prompt and eval configs included

skills/xui-deploy/evals/evals.json

@@ -0,0 +1,25 @@
+{
+  "skill_name": "xui-deploy",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "帮我在 VPS 上部署 x-ui，IP 是 198.51.100.42，SSH 用 root 登录，密钥在 ~/.ssh/id_rsa，KeePass 条目名是 'VPS-xui'",
+      "expected_output": "Agent uses kp-get.sh to retrieve username and password from KeePass entry 'VPS-xui' before running any commands. Tests SSH connectivity, runs the 3x-ui installer, configures panel settings using the retrieved credentials (never echoing the password), restarts the service, opens the firewall port, and reports the panel URL."
+    },
+    {
+      "id": 2,
+      "prompt": "I want to install 3x-ui on my Ubuntu 22.04 VPS at vps.example.com. SSH port is 2222, user is ubuntu, key at ~/.ssh/vps_key. Set panel port to 8443 and base path to /panel/. KeePass entry: 'vps.example.com'",
+      "expected_output": "Agent calls kp-get.sh with entry 'vps.example.com' to get UserName and Password. Uses non-default SSH port 2222, prefixes x-ui commands with sudo (non-root user), sets panel port to 8443 and base path to /panel/, then reports the panel URL as http://vps.example.com:8443/panel/."
+    },
+    {
+      "id": 3,
+      "prompt": "部署 x-ui，但我的 VPS 已经装过了，想更新到最新版本",
+      "expected_output": "Agent asks for VPS host, SSH credentials, and KeePass entry title if not provided. Runs the installer which detects the existing installation and updates it. Retrieves credentials via kp-get.sh, restarts the service, verifies it is running, and reports the updated version."
+    },
+    {
+      "id": 4,
+      "prompt": "在 CentOS 7 的 VPS 上安装 x-ui，IP 192.0.2.10，root 用户，密钥 ~/.ssh/id_ed25519。我没有 KeePass 条目，密码是 S3cr3t!",
+      "expected_output": "Agent detects no KeePass entry is available, accepts the password directly, reminds the user to save it to KeePass afterward, and never echoes the password in output. Detects CentOS 7, handles epel-release if needed, uses firewall-cmd to open the panel port, and reports the panel URL."
+    }
+  ]
+}