fix(ops): KB panel must not fetch groups while deactivated

[sulthannauval]

Found by the release-verification browser drive (the pass queued in #56): the plan-106 gate stopped rendering the library while off, but useAsync(kbGroups) lived in KbPanel itself — hooks fire on mount regardless of the early return, so the doomed 503 request still went out. The drive asserts on the network log, not the DOM, which is how it surfaced.

Change

Library (groups fetch + selection state + Documents/Graph chrome) moves to a child KbPanelBody mounted only when the KB is enabled — the request cannot exist while off.

Live drive evidence (real gateway + auth-aware probe mock, chromium)

activation card visible: true
inline error: embedding provider rejected the key (http 401)
still on activation card: true · nothing persisted
status row active: true · library chrome mounted: true · kb/groups: 200
off-with-key card + badge: true · config: {embedding_configured:true, enabled:false}
one-click reactivate: true
confirm modal wording ok · back to activation inputs, config empty

Panel-originated kb/groups while off: none. The one remaining page-load 503 is console-shell's chat-KB-selector prefetch — deliberately fail-soft (.catch(() => {})), renders nothing; out of scope.

Validation: next build clean · full flow driven end-to-end as above.

Risk: component split only · Rollback: revert