PM-5021: Replace challenge skills on update

[jmgasper]

What was broken
Draft challenge updates that removed skill chips left the old ChallengeSkill rows in place, so saved drafts still showed removed skills.

Root cause
The update path converted incoming skills to nested Prisma creates but never deleted existing ChallengeSkill records before creating the replacement set. Empty skill arrays also skipped skill validation, which could bypass the completed-challenge guard once replacement works.

What was changed
When an update payload includes skills, the API deletes existing ChallengeSkill rows in the same transaction before creating the submitted rows. Skill validation now treats an empty submitted array as an explicit update while still preserving skills when the field is omitted.

Any added/updated tests
Added unit coverage for replacing persisted challenge skills with a smaller submitted set.

Validation: npm run lint passed. npm test and the focused skill-replacement test are blocked locally because PostgreSQL is not running at localhost:5432, and npm run services:up cannot start it because docker-compose is not installed. npm run build cannot run because this package does not define a build script.