feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/projects/mod.rs

@@ -0,0 +1,108 @@
+pub mod tickets;
+
+use std::sync::Arc;
+
+use anyhow::Result;
+use sqlx::SqlitePool;
+
+use crate::db::projects::{self, Project};
+use crate::run_context::RunContext;
+
+pub struct ProjectManager {
+    db: Arc<SqlitePool>,
+}
+
+impl ProjectManager {
+    pub fn new(db: Arc<SqlitePool>) -> Self {
+        Self { db }
+    }
+
+    pub async fn list(&self) -> Result<Vec<Project>> {
+        projects::list(&self.db).await
+    }
+
+    pub async fn get(&self, id: i64) -> Result<Option<Project>> {
+        projects::get(&self.db, id).await
+    }
+
+    pub async fn create(
+        &self,
+        name:        &str,
+        path:        &str,
+        description: &str,
+        run_context: Option<&RunContext>,
+    ) -> Result<Project> {
+        let rc_json = run_context.map(|rc| rc.to_db());
+        projects::create(&self.db, name, path, description, rc_json.as_deref()).await
+    }
+
+    pub async fn update(
+        &self,
+        id:          i64,
+        name:        &str,
+        path:        &str,
+        description: &str,
+        run_context: Option<&RunContext>,
+    ) -> Result<bool> {
+        let rc_json = run_context.map(|rc| rc.to_db());
+        projects::update(&self.db, id, name, path, description, rc_json.as_deref()).await
+    }
+
+    pub async fn delete(&self, id: i64) -> Result<bool> {
+        projects::delete(&self.db, id).await
+    }
+}
+
+/// Builds the runtime `RunContext` for working on `project`, layering project-runtime
+/// fields over an optional pre-resolved `base` RC (which carries static config set at
+/// creation time, e.g. `security_group`).
+///
+/// Runtime fields computed here:
+/// - `working_directory` — always set to `project.path`.
+/// - `allow_fs_writes`   — project tree + Skald's own `data/` directory.
+/// - `system_prompt`     — project-context fragments prepended before any stored ones.
+///
+/// Shared by `ProjectTicketManager::start` (background ticket jobs) and the interactive
+/// project-chat session provisioning, so both work with identical context.
+pub fn build_runtime_run_context(project: &Project, base: Option<RunContext>) -> RunContext {
+    let mut rc = base.unwrap_or_default();
+
+    // Working directory is always the project path, overwritten at build time.
+    rc.working_directory = Some(project.path.clone());
+
+    // Absolute path to Skald's own data directory (user personal data store).
+    let skald_data = std::env::current_dir()
+        .unwrap_or_default()
+        .join("data")
+        .to_string_lossy()
+        .into_owned();
+
+    // Grant write access to the project tree and Skald's data directory.
+    if !rc.allow_fs_writes.contains(&project.path) {
+        rc.allow_fs_writes.push(project.path.clone());
+    }
+    if !rc.allow_fs_writes.contains(&skald_data) {
+        rc.allow_fs_writes.push(skald_data.clone());
+    }
+
+    // Build runtime context fragments and prepend before any stored ones.
+    // Note: working directory is intentionally omitted here — the date/time/OS/WD
+    // tail block in MessageBuilder already reflects the effective WD from RunContext.
+    let project_header = if project.description.is_empty() {
+        format!("You are working on project \"{}\".", project.name)
+    } else {
+        format!("You are working on project \"{}\". Description: {}", project.name, project.description)
+    };
+    let mut injected = vec![
+        project_header,
+        format!(
+            "Personal user data is available at: {}. \
+             Consult it when the task requires knowledge about the user.",
+            skald_data
+        ),
+    ];
+    injected.extend(std::mem::take(&mut rc.system_prompt));
+    rc.system_prompt = injected;
+
+    rc
+}

crates/skald-core/src/projects/tickets.rs

@@ -0,0 +1,178 @@
+use std::sync::Arc;
+
+use anyhow::{Result, anyhow};
+use sqlx::SqlitePool;
+use tokio_util::sync::CancellationToken;
+use tracing::warn;
+
+use core_api::system_bus::{SystemEvent, SystemEventBus};
+
+use crate::cron::TaskManager;
+use crate::db::{project_tickets, project_tickets::ProjectTicket, projects};
+use crate::run_context::RunContext;
+
+pub struct ProjectTicketManager {
+    db:       Arc<SqlitePool>,
+    task_mgr: std::sync::OnceLock<Arc<TaskManager>>,
+}
+
+impl ProjectTicketManager {
+    pub fn new(db: Arc<SqlitePool>) -> Arc<Self> {
+        Arc::new(Self {
+            db,
+            task_mgr: std::sync::OnceLock::new(),
+        })
+    }
+
+    pub fn set_task_manager(&self, tm: Arc<TaskManager>) {
+        let _ = self.task_mgr.set(tm);
+    }
+
+    /// Subscribe to the system bus and react to `JobCompleted` events whose
+    /// `origin_ref` starts with `"PROJECT_TASK:"`. Spawns a background task.
+    pub fn start_listener(
+        self: Arc<Self>,
+        system_bus: Arc<SystemEventBus>,
+        shutdown:   CancellationToken,
+    ) -> tokio::task::JoinHandle<()> {
+        tokio::spawn(async move {
+            let mut rx = system_bus.subscribe();
+            loop {
+                tokio::select! {
+                    _ = shutdown.cancelled() => break,
+                    res = rx.recv() => {
+                        match res {
+                            Ok(SystemEvent::JobCompleted { origin_ref: Some(ref s), result, error, .. })
+                                if s.starts_with("PROJECT_TASK:") =>
+                            {
+                                if let Some(tid) = s.strip_prefix("PROJECT_TASK:")
+                                    .and_then(|n| n.parse::<i64>().ok())
+                                {
+                                    if let Err(e) = self.on_job_completed(
+                                        tid,
+                                        result.as_deref(),
+                                        error.as_deref(),
+                                    ).await {
+                                        warn!(error = %e, ticket_id = tid, "ticket completion failed");
+                                    }
+                                }
+                            }
+                            Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
+                                warn!("ProjectTicketManager: system_bus lagged by {n} events");
+                            }
+                            Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+                            _ => {}
+                        }
+                    }
+                }
+            }
+        })
+    }
+
+    // ── CRUD ─────────────────────────────────────────────────────────────────
+
+    pub async fn list(&self, project_id: i64) -> Result<Vec<ProjectTicket>> {
+        project_tickets::list_for_project(&self.db, project_id).await
+    }
+
+    pub async fn get(&self, id: i64) -> Result<Option<ProjectTicket>> {
+        project_tickets::get(&self.db, id).await
+    }
+
+    pub async fn create(
+        &self,
+        project_id:  i64,
+        title:       &str,
+        description: &str,
+        agent_id:    &str,
+        run_context: Option<&RunContext>,
+    ) -> Result<ProjectTicket> {
+        let rc_json = run_context.map(|rc| rc.to_db());
+        let ticket = project_tickets::create(
+            &self.db, project_id, title, description, agent_id, rc_json.as_deref(),
+        ).await?;
+        projects::touch(&self.db, project_id).await?;
+        Ok(ticket)
+    }
+
+    pub async fn delete(&self, id: i64) -> Result<bool> {
+        let ticket = project_tickets::get(&self.db, id).await?;
+        let found  = project_tickets::delete(&self.db, id).await?;
+        if found {
+            if let Some(t) = ticket {
+                projects::touch(&self.db, t.project_id).await?;
+            }
+        }
+        Ok(found)
+    }
+
+    // ── Lifecycle ─────────────────────────────────────────────────────────────
+
+    /// Builds a runtime RunContext and starts the ticket as a background job.
+    ///
+    /// The stored RC (ticket → project) carries only static config set at creation
+    /// time (e.g. `security_group`). All runtime fields are computed here:
+    /// - `working_directory` — always set to `project.path`
+    /// - `allow_fs_writes`  — project tree + Skald's own `data/` directory
+    /// - `system_prompt`    — project context fragments prepended before any stored ones
+    pub async fn start(&self, ticket_id: i64) -> Result<()> {
+        let task_mgr = self.task_mgr.get()
+            .ok_or_else(|| anyhow!("ProjectTicketManager: task_manager not initialized"))?;
+
+        let ticket  = project_tickets::get(&self.db, ticket_id).await?
+            .ok_or_else(|| anyhow!("ticket {ticket_id} not found"))?;
+        let project = projects::get(&self.db, ticket.project_id).await?
+            .ok_or_else(|| anyhow!("project {} not found", ticket.project_id))?;
+
+        // Resolve base RC (ticket override → project default → empty), then layer the
+        // project-runtime fields (WD, fs-write grants, project-context system prompt).
+        // The stored RC carries only static config (e.g. security_group set at creation).
+        let base: Option<RunContext> =
+            ticket.run_context.as_deref().and_then(RunContext::from_db)
+            .or_else(|| project.run_context.as_deref().and_then(RunContext::from_db));
+        let rc = super::build_runtime_run_context(&project, base);
+
+        let origin_ref = format!("PROJECT_TASK:{ticket_id}");
+        let rc_json    = rc.to_db();
+
+        let job = task_mgr.spawn_async_job(
+            &ticket.title,
+            &ticket.description,
+            &ticket.description,
+            &ticket.agent_id,
+            Some(&rc_json),
+            &origin_ref,
+        )?;
+
+        project_tickets::start(&self.db, ticket_id, job.id).await?;
+        projects::touch(&self.db, ticket.project_id).await?;
+        Ok(())
+    }
+
+    /// Called when a `SystemEvent::JobCompleted` with matching `origin_ref` is received.
+    async fn on_job_completed(
+        &self,
+        ticket_id: i64,
+        result:    Option<&str>,
+        error:     Option<&str>,
+    ) -> Result<()> {
+        let project_id = project_tickets::get(&self.db, ticket_id).await?
+            .map(|t| t.project_id);
+        project_tickets::complete(&self.db, ticket_id, result, error).await?;
+        if let Some(pid) = project_id {
+            projects::touch(&self.db, pid).await?;
+        }
+        Ok(())
+    }
+
+    /// Reset a ticket back to todo, clearing all run state.
+    pub async fn reset(&self, ticket_id: i64) -> Result<()> {
+        let project_id = project_tickets::get(&self.db, ticket_id).await?
+            .map(|t| t.project_id);
+        project_tickets::reset(&self.db, ticket_id).await?;
+        if let Some(pid) = project_id {
+            projects::touch(&self.db, pid).await?;
+        }
+        Ok(())
+    }
+}