feat: 13 specialist agents + 3 team orchestration commands + az CLI + read-everywhere perms

Agents (10 new, total 13):
- python-fastapi-expert   — chat-gw / xiaoshou / CloudCost / kb-chat-python
- nestjs-expert           — gongdan backend
- react-frontend-expert   — xiaoshou/gongdan/casdoor web
- mcp-tools-architect     — chat-gw tool registry + auth pipeline
- celery-worker-expert    — CloudCost async tasks + beat
- security-auditor        — OWASP + secrets + auth (read-only)
- test-engineer           — coverage + flaky + e2e
- ci-cd-engineer          — 6 repos GitHub Actions
- azure-aca-expert        — ACA + Bicep + Key Vault
- docs-writer             — README / API / runbook

Team orchestration commands:
- /team-feature   — brainstorm → architect → split → parallel impl → QA
- /team-bug-fix   — triage → RCA → fix → regression test → review
- /team-refactor  — scope → test-first → batch → verify

Infrastructure:
- Dockerfile: add Azure CLI (native apt package)
- docker-compose.yml: mount ~/.azure and ~/.config/gh (read-only)
- scripts/enter.sh: banner showing agents/commands on start
- scripts/install-plugins.sh: helper to install superpowers/OMC/agent-browser

Permissions (.claude/settings.json):
- Full read access: az, gh, kubectl, psql SELECT, redis GET/KEYS/INFO
- Controlled write: gh pr create/comment, git push origin (not main)
- Hard deny: az */update|create|delete, gh pr merge, git push --force,
  alembic downgrade, kubectl apply/delete, sudo, rm -rf /

Docs:
- CLAUDE.md: new 'Agent 团队' + '权限模型' sections
- README.md: full agent roster + permission summary

Note: Dockerfile changed — run 'docker compose build' to install Azure CLI

Dockerfile

@@ -39,6 +39,15 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
     && apt-get update && apt-get install -y --no-install-recommends gh \
     && rm -rf /var/lib/apt/lists/*
 
+# Azure CLI（用于 azure-aca-expert agent 的只读查询）
+RUN curl -sL https://packages.microsoft.com/keys/microsoft.asc \
+      | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
+    && AZ_REPO=$(lsb_release -cs) \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/trusted.gpg.d/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" \
+      > /etc/apt/sources.list.d/azure-cli.list \
+    && apt-get update && apt-get install -y --no-install-recommends azure-cli \
+    && rm -rf /var/lib/apt/lists/*
+
 RUN pip install --break-system-packages --no-cache-dir \
       uv ruff black pytest pytest-asyncio httpx