Sync secure OpenUI skill credential guidance

[vishxrad]

Summary

• mirror the OpenUI skill credential-handling fix from thesysdev/skills#4
• remove secret-shaped literals and inline credential assignments from setup/build guidance
• keep authenticated MCP credentials server-side and scoped to an explicitly approved provider origin

Why

The skills.sh Snyk audit marks the OpenUI skill as High Risk (W007) because the instructions include literal sk-* values in shell commands. PR #841 restored skills/openui as a temporary compatibility mirror for @openuidev/cli 0.0.7–0.1.7, so the legacy OpenUI-repository install path needs the same correction as the canonical skills repository.

Current CLI releases continue to install from thesysdev/skills; that repository remains the source of truth.

Dependency

• Canonical change: Avoid credential literals in OpenUI skill guidance skills#4
• Compatibility mirror introduced by: Restore OpenUI skill for legacy CLI releases #841
• Tracking: TH-2427

Merge thesysdev/skills#4 first. If it changes during review, update this mirror to match its final contents before merging.

Validation

• skills/openui matches the canonical PR worktree byte-for-byte
• OpenUI skill validation passes with quick_validate.py
• no sk-*, OPENAI_API_KEY=..., or THESYS_API_KEY=... literal assignments remain in the skill tree
• git diff --check
• forward-tested the scaffold/build instructions without emitting credential assignments