feat: move shader submissions from web to CLI + MCP

[devallibus]

Summary

• Extract submission logic (resolve-source, ai-parse, github-pr, build-manifest) from the web app into packages/cli/src/lib/ as pure, testable functions
• Add submit command to CLI with --repo, --json flags and stdin support
• Add submit_shader tool to MCP server (both JSON-RPC and legacy HTTP endpoint)
• Remove /submit route, AiSubmitWizard, LibraryList, and nav link from web app
• 24 new tests across resolve-source, build-manifest, github-pr, submit command, and MCP handlers

Test plan

• bun run check passes (test + typecheck + validate + build)
• shaderbase CLI shows submit in help text
• MCP tools/list returns 3 tools including submit_shader
• Web app builds without /submit route or nav link
• Manual: shaderbase submit <shadertoy-url> with real API keys creates a PR
• Manual: MCP submit_shader tool call with real Worker secrets creates a PR

🤖 Generated with Claude Code

[devallibus]

I went through the diff locally and ran the current validation entrypoints (bun run test, bun run typecheck, bun run build:web) plus the new package-local suites in packages/cli and packages/mcp.

Two things look worth fixing before merge:

1. The root check script does not actually exercise the new submit-path tests. package.json:15-17 still limits test:cli to registry-types, search, and add, so the new coverage in packages/cli/src/lib/build-manifest.test.ts, packages/cli/src/lib/github-pr.test.ts, packages/cli/src/lib/resolve-source.test.ts, and packages/cli/src/commands/submit.test.ts is skipped by bun run check. That means the PR description currently overstates what CI is proving, and regressions in the newly extracted submission flow can slip through unless those tests are wired into the root test script.

2. The repo docs still advertise the removed web submission flow. README.md:16, README.md:74, and README.md:81-83 still say the web app provides AI submit via /submit, but this PR deletes apps/web/src/routes/submit.tsx and removes the nav entry. After this lands, contributors following the README will be sent to a route that no longer exists. The README should be updated to point people at shaderbase submit / submit_shader instead.

Other than that, the extracted CLI/MCP path looks coherent, and the web app still builds cleanly after the route removal.

[devallibus]

Re-reviewed after the follow-up commit.

The two issues I called out are addressed:

• package.json now wires the new CLI submit-path tests into the root test:cli script, so bun run check exercises the extracted submission flow.
• README.md no longer points contributors at the removed /submit web route and now documents the CLI / MCP submission paths instead.

I do not see any additional findings in the updated PR.