docs(api): metadata-api packages section — bare POST installs, publish moved to /packages/publish

The doc described the pre-#3610 collision state: bare POST /packages as
marketplace publish. That path is install (409 duplicate guard, overwrite
opt-in); publish now lives at POST /packages/publish.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LX9ut3MK3KykE11S9bJmv5

Author: claude

content/docs/api/metadata-api.mdx

@@ -70,7 +70,16 @@ List installed packages.
 
 ### `POST /packages`
 
-Publish a package (manifest + metadata) to the package registry.
+Install a package from its manifest (SDK: `client.packages.install`). Re-installing an
+already-installed `id` returns **409 Conflict** unless `overwrite: true`.
+
+**Body**: `{ manifest: { id: "plugin-auth", name: "Plugin Auth", version: "1.0.0", ... }, settings?: { ... }, enableOnInstall?: true, overwrite?: false }`  
+**Response**: `{ package: { id: "plugin-auth", version: "1.0.0", ... }, message?: "..." }`
+
+### `POST /packages/publish`
+
+Publish a package (manifest + metadata) to the package marketplace registry. This is
+publisher tooling, not part of the app SDK surface.
 
 **Body**: `{ manifest: { id: "plugin-auth", name: "Plugin Auth", version: "1.0.0", ... }, metadata: { objects: [...], views: [...], ... } }`  
 **Response**: `{ success: true, message: "...", package: { id: "plugin-auth", version: "1.0.0" } }`