feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/provider/mod.rs

@@ -0,0 +1,77 @@
+// All provider types and traits now live in core-api.
+// Re-export everything so existing imports in this crate continue to work.
+pub use core_api::provider::{
+    ApiProvider, ApiProviderRegistry, BuiltLlmClient,
+    LlmModelRecord, LlmProviderRecord, LlmStrength,
+    ProviderField, ProviderUiMeta, ReasoningMode, ServiceType,
+    RemoteLlmModelInfo,
+};
+
+// ── ProviderRegistry ──────────────────────────────────────────────────────────
+
+use std::sync::Arc;
+use core_api::system_bus::{SystemEvent, SystemEventBus};
+
+pub struct ProviderRegistry {
+    builtin:    Vec<Arc<dyn ApiProvider>>,
+    plugins:    std::sync::RwLock<Vec<Arc<dyn ApiProvider>>>,
+    system_bus: Arc<SystemEventBus>,
+}
+
+impl ProviderRegistry {
+    pub fn new(system_bus: Arc<SystemEventBus>) -> Self {
+        Self {
+            builtin: Vec::new(),
+            plugins: std::sync::RwLock::new(Vec::new()),
+            system_bus,
+        }
+    }
+
+    pub fn register_builtin(&mut self, p: impl ApiProvider + 'static) {
+        self.builtin.push(Arc::new(p));
+    }
+
+    /// Looks up a provider by type_id. Plugin providers shadow built-in ones.
+    pub fn get(&self, type_id: &str) -> Option<Arc<dyn ApiProvider>> {
+        {
+            let plugins = self.plugins.read().unwrap();
+            if let Some(p) = plugins.iter().find(|p| p.type_id() == type_id) {
+                return Some(Arc::clone(p));
+            }
+        }
+        self.builtin.iter().find(|p| p.type_id() == type_id).cloned()
+    }
+
+    /// Returns all known providers: plugin-registered first, then built-in.
+    pub fn all(&self) -> Vec<Arc<dyn ApiProvider>> {
+        let plugins = self.plugins.read().unwrap();
+        let mut result: Vec<Arc<dyn ApiProvider>> = plugins.clone();
+        for p in &self.builtin {
+            if !result.iter().any(|x| x.type_id() == p.type_id()) {
+                result.push(Arc::clone(p));
+            }
+        }
+        result
+    }
+
+    pub fn contains(&self, type_id: &str) -> bool {
+        self.get(type_id).is_some()
+    }
+}
+
+impl core_api::provider::ApiProviderRegistry for ProviderRegistry {
+    fn register_plugin(&self, p: Arc<dyn ApiProvider>) {
+        let id = p.type_id();
+        let mut plugins = self.plugins.write().unwrap();
+        plugins.retain(|x| x.type_id() != id);
+        plugins.push(p);
+        tracing::info!(type_id = id, "provider registered (plugin)");
+        self.system_bus.send(SystemEvent::ApiProviderRegistered { type_id: id.to_string() });
+    }
+
+    fn unregister_plugin(&self, type_id: &str) {
+        self.plugins.write().unwrap().retain(|p| p.type_id() != type_id);
+        tracing::info!(type_id, "provider unregistered (plugin)");
+        self.system_bus.send(SystemEvent::ApiProviderUnregistered { type_id: type_id.to_string() });
+    }
+}