docs(server): improve first-contributor experience

[staging-devin-ai-integration]

Summary

Addresses several pain points discovered during a fresh Ubuntu 22.04 setup. Changes span the justfile (bug fixes + DX improvements), documentation (prerequisite coverage), and dependency updates.

Justfile fixes:

• just dev was broken: cd server referenced a nonexistent directory. Fixed to run cargo watch from workspace root with -p streamkit-server.
• just skit now gives a friendly error when ui/dist/ is missing instead of a cryptic RustEmbed derive macro compile error. New check-ui-dist pre-flight recipe.
• lint-skit/fix-skit rebuild ping-pong eliminated: reordered to run the moq-featured clippy pass on streamkit-server first, then --workspace --exclude streamkit-server for the rest. This avoids the two passes invalidating each other's cache on every run (~30s saved on repeated lints).

Documentation:

• CONTRIBUTING.md: expanded with a full "Prerequisites (detailed)" section covering system packages, Rust/Bun/Just install commands, linting tools (cargo-deny, reuse), cargo-watch, and native plugin dev deps (clang, libclang-dev).
• docs/getting-started/installation.md: added system library requirements to the Required list and optional tooling (cargo-deny, reuse, clang) to the Optional list.

Dependency updates:

• time crate bumped 0.3.45 → 0.3.47 (+ transitive deps num-conv, time-core, time-macros) to resolve RUSTSEC-2026-0009 (DoS via stack exhaustion in RFC 2822 parsing).
• bytes crate bumped 1.11.0 → 1.11.1 to resolve RUSTSEC-2026-0007 (integer overflow in BytesMut::reserve).

Both were blocking cargo deny in CI.

Updates since last revision

• Commits re-signed with the provisioned GPG key (devin@streamkit.dev) so that signature verification passes. No code changes.

Review & Testing Checklist for Human

• Lint reorder semantics: the new lint-skit no longer lints streamkit-server without the moq feature — only with it. There is one #[cfg(not(feature = "moq"))] usage at apps/skit/src/server.rs:3544 (let _ = &app_state;, a dead-code suppression hint). Verify you're comfortable losing that no-moq lint coverage for the server crate.
• check-ui-dist scope: currently wired only to just skit. Other recipes that also need ui/dist/ (build-skit, skit-profiling, skit-console, skit-dhat) do not have this guard. Decide whether they should.
• Test just dev on a machine with cargo-watch installed — confirm the backend starts and hot-reloads correctly. (Only just skit serve was tested locally by Devin; hot-reload via cargo-watch was not exercised.)
• Test just skit without ui/dist/ — confirm the friendly error message appears instead of the RustEmbed compile error.
• Docs completeness: verify the listed apt packages are sufficient for a fresh Ubuntu 22.04 build (the list was derived from manual setup notes, not an automated clean-room test).

Notes

• Link to Devin run (initial)
• Link to Devin run (commit signing)
• Requested by: @streamer45

[staging-devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring