feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/clarification/mod.rs

@@ -0,0 +1,107 @@
+use std::sync::Arc;
+use std::sync::atomic::{AtomicI64, Ordering};
+
+use chrono::Utc;
+use serde::Serialize;
+use tokio::sync::{broadcast, oneshot};
+use tracing::info;
+
+use crate::events::{GlobalEvent, ServerEvent};
+use crate::pending_registry::PendingRegistry;
+
+#[derive(Debug, Clone, Serialize)]
+pub struct PendingClarificationInfo {
+    pub request_id:        i64,
+    pub session_id:        i64,
+    pub agent_id:          String,
+    pub source:            String,
+    pub context_label:     Option<String>,
+    pub title:             String,
+    pub question:          String,
+    pub suggested_answers: Vec<String>,
+    pub created_at:        String,
+}
+
+pub struct ClarificationManager {
+    /// Shared pending-request plumbing (map + oneshot). Keyed by `request_id`.
+    registry: PendingRegistry<PendingClarificationInfo, String>,
+    next_id:  AtomicI64,
+    /// Global event bus sender, mirroring `ApprovalManager`. Used to broadcast
+    /// `ClarificationRequested` / `ClarificationResolved` so Inbox subscribers
+    /// (e.g. the mobile-connector plugin) can re-snapshot.
+    event_tx: broadcast::Sender<GlobalEvent>,
+}
+
+impl ClarificationManager {
+    pub fn new(event_tx: broadcast::Sender<GlobalEvent>) -> Arc<Self> {
+        Arc::new(Self {
+            registry: PendingRegistry::new(),
+            next_id:  AtomicI64::new(1),
+            event_tx,
+        })
+    }
+
+    pub async fn register(
+        &self,
+        session_id:        i64,
+        agent_id:          &str,
+        source:            &str,
+        context_label:     Option<&str>,
+        title:             &str,
+        question:          &str,
+        suggested_answers: Vec<String>,
+    ) -> (i64, oneshot::Receiver<String>) {
+        let request_id = self.next_id.fetch_add(1, Ordering::SeqCst);
+
+        let info = PendingClarificationInfo {
+            request_id,
+            session_id,
+            agent_id:      agent_id.to_string(),
+            source:        source.to_string(),
+            context_label: context_label.map(str::to_string),
+            title:         title.to_string(),
+            question:      question.to_string(),
+            suggested_answers,
+            created_at:    Utc::now().to_rfc3339(),
+        };
+
+        let rx = self.registry.insert(request_id, info).await;
+        info!(session_id, agent = agent_id, source, request_id, "clarification: pending registered");
+        // Broadcast on the global bus; counterpart of the per-session
+        // `AgentQuestion` WS event.
+        let _ = self.event_tx.send(GlobalEvent {
+            source:     Some(source.to_string()),
+            session_id: Some(session_id),
+            event:      ServerEvent::ClarificationRequested {
+                request_id,
+                title: title.to_string(),
+            },
+        });
+        (request_id, rx)
+    }
+
+    pub async fn resolve(&self, request_id: i64, answer: String) -> bool {
+        match self.registry.resolve(request_id, answer).await {
+            Some(info) => {
+                info!(request_id, "clarification: resolved");
+                let _ = self.event_tx.send(GlobalEvent {
+                    source:     Some(info.source),
+                    session_id: Some(info.session_id),
+                    event:      ServerEvent::ClarificationResolved { request_id },
+                });
+                true
+            }
+            None => false,
+        }
+    }
+
+    pub async fn list_pending(&self) -> Vec<PendingClarificationInfo> {
+        let mut items = self.registry.list().await;
+        items.sort_by(|a, b| a.created_at.cmp(&b.created_at));
+        items
+    }
+
+    pub async fn cancel_for_session(&self, session_id: i64) {
+        self.registry.remove_where(|i| i.session_id == session_id).await;
+    }
+}