feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/llm/mod.rs

@@ -0,0 +1,82 @@
+pub(crate) mod db;
+pub mod manager;
+pub mod providers;
+
+use std::sync::Arc;
+
+use crate::chatbot::ChatbotClient;
+use crate::provider::ServiceType;
+
+pub use core_api::provider::{LlmProviderRecord, LlmModelRecord, LlmStrength, ReasoningMode};
+pub use manager::{LlmManager, sort_models_for_agent};
+
+/// A resolved, ready-to-use LLM client with its associated metadata.
+#[derive(Clone)]
+pub struct LlmEntry {
+    pub client:          Arc<dyn ChatbotClient>,
+    pub model:           String,
+    pub model_db_id:     i64,
+    pub strength:        Option<LlmStrength>,
+    pub scope:           Vec<String>,
+    pub extra_params:    Option<serde_json::Value>,
+    /// Max input context window in tokens, if known.
+    pub context_length:  Option<i64>,
+    /// When true, prompt-caching hints are injected into requests.
+    pub prompt_cache:    bool,
+}
+
+// ── Provider ──────────────────────────────────────────────────────────────────
+
+/// Public provider metadata (no api_key).
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct LlmProviderInfo {
+    pub id:              i64,
+    pub name:            String,
+    #[serde(rename = "type")]
+    pub provider:        String,
+    pub base_url:        Option<String>,
+    pub description:     Option<String>,
+    /// Service types this provider supports (from ProviderRegistry at runtime).
+    pub supported_types: Vec<ServiceType>,
+}
+
+/// Public model metadata for API responses (includes provider name for convenience).
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct LlmModelInfo {
+    pub id:                       i64,
+    pub provider_id:              i64,
+    pub provider_name:            String,
+    pub model_id:                 String,
+    pub name:                     String,
+    pub strength:                 Option<LlmStrength>,
+    pub scope:                    Vec<String>,
+    pub is_default:               bool,
+    pub priority:                 i32,
+    pub extra_params:             Option<serde_json::Value>,
+    pub context_length:           Option<i64>,
+    pub max_output_tokens:        Option<i64>,
+    pub knowledge_cutoff:         Option<String>,
+    pub capabilities:             Vec<String>,
+    pub status:                   ClientStatus,
+    pub last_error:               Option<String>,
+    /// Input (prompt) price per million tokens (USD) from the provider catalog cache.
+    pub price_input_per_million:  Option<f64>,
+    /// Output (completion) price per million tokens (USD) from the provider catalog cache.
+    pub price_output_per_million: Option<f64>,
+    /// Currently-selected reasoning value (string for a `ValueSet`, number for a
+    /// `Range`, or `None`). Round-trips to the edit form.
+    pub reasoning:                Option<serde_json::Value>,
+    /// Reasoning control descriptor for this model (drives the UI control), or
+    /// `None` if the model does not support reasoning.
+    pub reasoning_mode:           Option<ReasoningMode>,
+}
+
+// ── Health ────────────────────────────────────────────────────────────────────
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ClientStatus {
+    Healthy,
+    Degraded,
+    Down,
+}