feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/skald/accessors.rs

@@ -0,0 +1,102 @@
+//! The logical API surface of `Skald`: one accessor per manager, named after the
+//! historical field, delegating into the domain bundle that now owns it. This is
+//! the intentional surface consumers (frontend handlers, plugin context) use — the
+//! bundles themselves stay internal.
+//!
+//! Now that the core is its own crate, this is a real boundary rather than a
+//! convention: everything here is `pub` because the `skald` binary lives outside,
+//! and everything not here is unreachable from it. Promote the block to a
+//! `SkaldApi` trait if the shells ever need to mock it.
+
+use std::sync::Arc;
+
+use sqlx::SqlitePool;
+use tokio::sync::RwLock;
+use tokio_util::sync::CancellationToken;
+
+use core_api::remote::RemoteAccess;
+use core_api::system_bus::SystemEventBus;
+
+use crate::approval::ApprovalManager;
+use crate::chat_event_bus::ChatEventBus;
+use crate::chat_hub::ChatHub;
+use crate::clarification::ClarificationManager;
+use crate::command::LlmCommandManager;
+use crate::config_store::GlobalConfigManager;
+use crate::cron::TaskManager;
+use crate::elicitation::ElicitationManager;
+use crate::image_generate::ImageGeneratorManager;
+use crate::inbox::Inbox;
+use crate::latex::LatexCompiler;
+use crate::llm::LlmManager;
+use crate::location::LocationManager;
+use crate::mcp::McpManager;
+use crate::memory::MemoryManager;
+use crate::plugin::PluginManager;
+use crate::projects::tickets::ProjectTicketManager;
+use crate::projects::ProjectManager;
+use crate::provider::ProviderRegistry;
+use crate::run_context::RunContextManager;
+use crate::secrets::SecretsStore;
+use crate::session::manager::ChatSessionManager;
+use crate::tic::TicManager;
+use crate::tool_catalog::ToolCatalog;
+use crate::tools::ToolRegistry;
+use crate::transcribe::TranscribeManager;
+use crate::tts::TtsManager;
+use crate::users::UserManager;
+
+use super::Skald;
+
+impl Skald {
+    // Runtime / cross-cutting
+    pub fn db(&self) -> &Arc<SqlitePool> { &self.rt.db }
+    pub fn users(&self) -> &Arc<UserManager> { &self.rt.users }
+    pub fn config(&self) -> &Arc<GlobalConfigManager> { &self.rt.config }
+    pub fn config_properties(&self) -> &[core_api::ConfigSet] { &self.rt.config_properties }
+    pub fn system_bus(&self) -> &Arc<SystemEventBus> { &self.rt.system_bus }
+    pub fn event_bus(&self) -> &Arc<ChatEventBus> { &self.rt.event_bus }
+    pub fn shutdown_token(&self) -> &CancellationToken { &self.rt.shutdown_token }
+
+    // Models
+    pub fn provider_registry(&self) -> &Arc<ProviderRegistry> { &self.models.provider_registry }
+    pub fn llm_manager(&self) -> &Arc<LlmManager> { &self.models.llm_manager }
+    pub fn secrets(&self) -> &Arc<SecretsStore> { &self.models.secrets }
+    pub fn memory_manager(&self) -> &Arc<MemoryManager> { &self.models.memory_manager }
+
+    // Media
+    pub fn image_generator_manager(&self) -> &Arc<ImageGeneratorManager> { &self.media.image_generator_manager }
+    pub fn transcribe_manager(&self) -> &Arc<TranscribeManager> { &self.media.transcribe_manager }
+    pub fn tts_manager(&self) -> &Arc<TtsManager> { &self.media.tts_manager }
+
+    // Tools
+    pub fn tools(&self) -> &Arc<ToolRegistry> { &self.tools.tools }
+    pub fn catalog(&self) -> &ToolCatalog { &self.tools.catalog }
+    pub fn command_manager(&self) -> &Arc<LlmCommandManager> { &self.tools.command_manager }
+
+    // Integrations
+    pub fn mcp(&self) -> &Arc<McpManager> { &self.integrations.mcp }
+    pub fn plugin_manager(&self) -> &Arc<PluginManager> { &self.integrations.plugin_manager }
+
+    // Tasks
+    pub fn cron(&self) -> &Arc<TaskManager> { &self.tasks.cron }
+    pub fn projects(&self) -> &Arc<ProjectManager> { &self.tasks.projects }
+    pub fn ticket_manager(&self) -> &Arc<ProjectTicketManager> { &self.tasks.ticket_manager }
+
+    // Conversation
+    pub fn manager(&self) -> &Arc<ChatSessionManager> { &self.conversation.manager }
+    pub fn chat_hub(&self) -> &Arc<ChatHub> { &self.conversation.chat_hub }
+    pub fn run_context_manager(&self) -> &Arc<RunContextManager> { &self.conversation.run_context_manager }
+    pub fn tic_manager(&self) -> &Arc<TicManager> { &self.conversation.tic_manager }
+
+    // Interaction
+    pub fn approval(&self) -> &Arc<ApprovalManager> { &self.interaction.approval }
+    pub fn inbox(&self) -> &Inbox { &self.interaction.inbox }
+    pub fn clarification(&self) -> &Arc<ClarificationManager> { &self.interaction.clarification }
+    pub fn elicitation(&self) -> &Arc<ElicitationManager> { &self.interaction.elicitation }
+
+    // Infra
+    pub fn latex_compiler(&self) -> &LatexCompiler { &self.infra.latex_compiler }
+    pub fn location_manager(&self) -> &Arc<LocationManager> { &self.infra.location_manager }
+    pub fn remote(&self) -> &Arc<RwLock<Option<Arc<dyn RemoteAccess>>>> { &self.infra.remote }
+}