feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/db/chat_sessions.rs

@@ -0,0 +1,76 @@
+use sqlx::SqlitePool;
+
+pub struct ChatSession {
+    pub id:              i64,
+    pub source:          String,
+    pub agent_id:        String,
+    /// True when a real user is actively participating (web, telegram).
+    /// False for fully automated sessions (cron, tic).
+    pub is_interactive:  bool,
+    /// True for short-lived task sessions (cron, tic) with no long-term
+    /// conversational value. May be used to skip memory / analytics sinks.
+    pub is_ephemeral:    bool,
+    /// Optional RunContext JSON blob assigned to this session.
+    /// `None` resolves to the implicit "default" run_context at runtime.
+    pub run_context:     Option<String>,
+}
+
+pub async fn create(
+    pool:           &SqlitePool,
+    agent_id:       &str,
+    source:         &str,
+    is_interactive: bool,
+    is_ephemeral:   bool,
+) -> anyhow::Result<ChatSession> {
+    let id = sqlx::query_scalar::<_, i64>(
+        "INSERT INTO chat_sessions (source, agent_id, is_interactive, is_ephemeral)
+         VALUES (?, ?, ?, ?) RETURNING id",
+    )
+    .bind(source)
+    .bind(agent_id)
+    .bind(is_interactive as i64)
+    .bind(is_ephemeral as i64)
+    .fetch_one(pool)
+    .await?;
+
+    Ok(ChatSession {
+        id,
+        source:         source.to_string(),
+        agent_id:       agent_id.to_string(),
+        is_interactive,
+        is_ephemeral,
+        run_context: None,
+    })
+}
+
+pub async fn set_run_context(
+    pool:        &SqlitePool,
+    id:          i64,
+    run_context: Option<&str>,
+) -> anyhow::Result<()> {
+    sqlx::query("UPDATE chat_sessions SET run_context = ? WHERE id = ?")
+        .bind(run_context)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+pub async fn find_by_id(pool: &SqlitePool, id: i64) -> anyhow::Result<Option<ChatSession>> {
+    let row = sqlx::query_as::<_, (i64, String, String, bool, bool, Option<String>)>(
+        "SELECT id, source, agent_id, is_interactive, is_ephemeral, run_context
+         FROM chat_sessions WHERE id = ?",
+    )
+    .bind(id)
+    .fetch_optional(pool)
+    .await?;
+
+    Ok(row.map(|(id, source, agent_id, is_interactive, is_ephemeral, run_context)| ChatSession {
+        id,
+        source,
+        agent_id,
+        is_interactive,
+        is_ephemeral,
+        run_context,
+    }))
+}