feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/session/handler/outcome.rs

@@ -0,0 +1,92 @@
+//! Shared recording of a single tool-call outcome.
+//!
+//! The persist-then-emit tail of a tool call (`ExecutionOutcome` → DB row +
+//! `ToolDone`/`ToolError`/`ToolCancelled` event) was copy-pasted into both the live
+//! loop (`run_agent_turn`) and `resume_pending_tools`. `record_tool_outcome` is the
+//! single implementation both call.
+
+use serde_json::Value;
+use tracing::{debug, info, warn};
+
+use crate::chat_event_bus::ToolCallEvent;
+use crate::db::chat_llm_tools;
+use crate::tools::{is_file_write_tool, ExecutionOutcome};
+
+use super::ChatSessionHandler;
+use super::emitter::TurnEmitter;
+
+/// Whether the enclosing loop should keep going after an outcome is recorded.
+pub(super) enum RecordFlow {
+    /// Continue with the next tool call / round.
+    Continue,
+    /// The tool was cancelled by the user — the caller must end the turn.
+    Abort,
+}
+
+impl ChatSessionHandler {
+    /// Persists one tool-call outcome and emits the matching lifecycle event.
+    /// Returns [`RecordFlow::Abort`] for a user cancellation (the caller ends the
+    /// turn), [`RecordFlow::Continue`] otherwise.
+    ///
+    /// When `accumulate` is `Some` (the live turn), the call is also appended to the
+    /// turn's `ToolCallEvent` list for the chat-event bus, and a `FileChanged` event
+    /// is emitted for a successful file-write tool. `resume_pending_tools` passes
+    /// `None`: it neither accumulates nor re-emits `FileChanged`.
+    pub(super) async fn record_tool_outcome(
+        &self,
+        tool_call_id: i64,
+        tool_name:    &str,
+        args:         &Value,
+        outcome:      ExecutionOutcome,
+        em:           &TurnEmitter<'_>,
+        accumulate:   Option<&mut Vec<ToolCallEvent>>,
+    ) -> anyhow::Result<RecordFlow> {
+        let pool = &self.db;
+        match outcome {
+            ExecutionOutcome::Completed(result) => {
+                let wire = result.to_wire();
+                let kind = result.kind();
+                debug!(session_id = self.session_id, tool = %tool_name, tool_call_id, result_len = wire.len(), "tool done");
+                chat_llm_tools::complete(pool, tool_call_id, &wire, kind).await?;
+                if let Some(acc) = accumulate {
+                    if is_file_write_tool(tool_name)
+                        && let Some(p) = args["path"].as_str()
+                    {
+                        em.file_changed(crate::approval::normalize_path(p)).await;
+                    }
+                    acc.push(ToolCallEvent {
+                        name:      tool_name.to_string(),
+                        arguments: Some(serde_json::to_string(args).unwrap_or_default()),
+                        result:    Some(wire.clone()),
+                        status:    "done".to_string(),
+                    });
+                }
+                em.tool_done(tool_call_id, wire, kind.to_string()).await;
+                Ok(RecordFlow::Continue)
+            }
+            ExecutionOutcome::Failed(msg) => {
+                warn!(session_id = self.session_id, tool = %tool_name, tool_call_id, error = %msg, "tool failed");
+                chat_llm_tools::fail(pool, tool_call_id, &msg).await?;
+                if let Some(acc) = accumulate {
+                    acc.push(ToolCallEvent {
+                        name:      tool_name.to_string(),
+                        arguments: Some(serde_json::to_string(args).unwrap_or_default()),
+                        result:    Some(msg.clone()),
+                        status:    "failed".to_string(),
+                    });
+                }
+                em.tool_error(tool_call_id, msg).await;
+                Ok(RecordFlow::Continue)
+            }
+            ExecutionOutcome::Cancelled => {
+                // A /stop hit this tool mid-flight. Record it as cancelled (not
+                // failed); the sticky token cancels the rest of the loop by
+                // construction, so the caller just ends the turn.
+                info!(session_id = self.session_id, tool = %tool_name, tool_call_id, "tool cancelled by user");
+                chat_llm_tools::cancel(pool, tool_call_id, "Cancelled by user.").await?;
+                em.tool_cancelled(tool_call_id).await;
+                Ok(RecordFlow::Abort)
+            }
+        }
+    }
+}