feat(cli): support --dependencies for script actions

- action add/update: new --dependencies <json> option
- parseDependencies accepts JSON, name@version shorthand, or bare names
- update is incremental; --dependencies replaces the whole array
- docs: deployment/systemd.md + skill SKILL/action-types/development
  document the npm-deps feature and the service-PATH requirement
  (spawn npm ENOENT without nvm bin dir on PATH)

.agents/skills/inkreach-teable/guides/development.md

@@ -59,6 +59,21 @@ via `process.env.NAME` (this is allowed — only `process.env` is exposed, not
 `triggerInput._apiBaseUrl` for back-channel API calls. No `fs`, `eval`,
 `Function`, or `child_process`.
 
+### Script sandbox npm deps need npm on the service PATH
+Script actions CAN use npm packages — declare them via the CLI
+(`action add/update --dependencies '[{"name":"axios","version":"1.6.0"}]'`
+or shorthand `axios@1.6.0,dayjs`) and `require('axios')` works in-sandbox.
+The backend installs deps into a cache dir (`/tmp/teable-automation-deps/<hash>`)
+via `spawn('npm', ['install', ...])`, keyed by `name@version`.
+
+**Gotcha:** systemd user services default to `PATH=/usr/local/bin:/usr/bin:...`
+which OMITS the nvm bin dir where `npm` lives → scripts with deps fail with
+`Dependency install failed: spawn npm ENOENT`. Fix: add
+`Environment=PATH=/root/.nvm/versions/node/vX/bin:/usr/local/sbin:...` to
+`teable-backend.service`, `daemon-reload`, restart. Verify:
+`inkreach-teable workflow test <wfId>` on a script with `require('dayjs')` →
+`succeeded`.
+
 ### scheduledTime backend is a simplified implementation
 The backend `scheduled-time.trigger.ts` only honors `timing.type` + `timing.interval`.
 It ignores `triggerTime`, `weekdays`, `daysOfMonth`, `starting`, `ending`, `tz`.