feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/Cargo.toml

@@ -0,0 +1,82 @@
+[package]
+name = "skald-core"
+version = "0.1.0"
+edition = "2024"
+
+# The headless application core: database + crypto + identity, the LLM stack,
+# tools, MCP, plugins-as-a-registry, sessions.
+#
+# Deliberately knows nothing about the process shell around it. No Tauri, no
+# concrete plugin crates (it only ever sees `Arc<dyn Plugin>` from `core-api`),
+# no `axum` server — `skald` and `skald-setup` are both consumers.
+
+[dependencies]
+axum = { version = "0.8", features = ["ws", "multipart"] }
+tokio = { version = "1.52.3", features = ["full"] }
+tokio-util = { version = "0.7", features = ["rt"] }
+futures = "0.3"
+serde = { version = "1", features = ["derive"] }
+anyhow = "1"
+sqlx = { version = "0.9.0", features = ["runtime-tokio", "sqlite"] }
+# Per-user database encryption. `sqlx-sqlite` already builds `libsqlite3-sys`;
+# naming it here only adds a feature, and Cargo's feature unification turns the
+# one SQLite the process links into SQLCipher. A database opened without
+# `PRAGMA key` still behaves as plain SQLite, so `system.db` is unaffected.
+# `-vendored-openssl` compiles libcrypto from source instead of linking the
+# system one, so the binary stays self-contained (see b08a13c). It costs a C
+# build (perl + make) — the trade the blueprint §4 accepts explicitly.
+#
+# Pinned below 0.38 on purpose: `sqlx-sqlite` 0.9 requires ">=0.30.1, <0.38.0".
+# A newer release would resolve to a *second* copy of the crate, and the
+# SQLCipher feature would then apply to a SQLite that sqlx never links. 0.37.0
+# is the newest version that still unifies.
+libsqlite3-sys = { version = "0.37", features = ["bundled-sqlcipher-vendored-openssl"] }
+# 0.6 is still a release candidate; stay on the stable line.
+argon2  = "0.5"
+# Held at 0.10 to match `skald-relay-common`, so the binary links one AES-GCM
+# rather than two. Bumping to 0.11 means bumping the mobile E2E code with it.
+aes-gcm = "0.10"
+zeroize = { version = "1", features = ["derive"] }
+subtle  = "2"
+uuid    = { version = "1", features = ["v4"] }
+reqwest = { version = "0.13.4", default-features = false, features = ["rustls-no-provider", "charset", "http2", "system-proxy", "json", "multipart"] }
+async-trait = "0.1"
+serde_json = "1"
+indexmap = { version = "2", features = ["serde"] }
+tracing            = "0.1"
+chrono             = { version = "0.4", default-features = false, features = ["clock", "std"] }
+chrono-tz          = "0.10"
+iana-time-zone     = "0.1"
+os_info            = "3"
+cron               = "0.16"
+rand               = "0.10.1"
+syn                = { version = "2", features = ["full"] }
+quote              = "1"
+proc-macro2        = { version = "1", features = ["span-locations"] }
+tree-sitter            = "0.26"
+tree-sitter-python     = "0.25"
+tree-sitter-javascript = "0.25"
+tree-sitter-typescript = "0.23"
+tree-sitter-go         = "0.25"
+tree-sitter-java       = "0.23"
+tree-sitter-c          = "0.24"
+tree-sitter-cpp        = "0.23"
+tree-sitter-swift      = "0.7"
+tree-sitter-lua        = "0.5"
+tree-sitter-ruby       = "0.23"
+tree-sitter-bash       = "0.25"
+tree-sitter-elixir     = "0.3"
+tree-sitter-json       = "0.24"
+tree-sitter-yaml       = "0.7"
+tree-sitter-html       = "0.23"
+tree-sitter-css        = "0.25"
+regex              = "1"
+glob               = "0.3"
+libc               = "0.2"
+base64             = "0.22"
+sha2               = "0.10"
+notify             = "8"
+honcho-client            = { path = "../honcho-client" }
+llm-client               = { path = "../llm-client" }
+core-api                 = { path = "../core-api" }
+mcp-client               = { path = "../mcp-client" }