feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/skald/mod.rs

@@ -0,0 +1,99 @@
+//! `Skald` — the headless application core.
+//!
+//! `Skald` owns every manager but is no longer a God Object: the ~30 managers are
+//! grouped into a cross-cutting [`Runtime`] context plus eight cohesive domain
+//! bundles (see [`bundles`]). Construction is a staged composition root (each bundle
+//! has its own `build()`); the construction cycles are resolved in one place by
+//! [`wiring::wire`]; every background task is registered with a [`TaskSupervisor`]
+//! so shutdown joins them uniformly. The frontend and plugin context consume `Skald`
+//! only through the accessor methods in [`accessors`], never its fields — that
+//! accessor surface is the logical boundary a future `skald-core` crate would keep.
+
+use std::sync::Arc;
+
+use anyhow::Result;
+use sqlx::SqlitePool;
+use tracing::info;
+
+use core_api::plugin::Plugin;
+
+use super::config::CoreConfig;
+
+mod accessors;
+mod bundles;
+mod runtime;
+mod supervisor;
+mod wiring;
+
+use bundles::{Conversation, Infra, Integrations, Interaction, Media, Models, Tasks, Tools};
+use runtime::Runtime;
+use wiring::{spawn_background, wire};
+
+pub struct Skald {
+    rt:           Runtime,
+    models:       Models,
+    media:        Media,
+    tools:        Tools,
+    integrations: Integrations,
+    tasks:        Tasks,
+    conversation: Conversation,
+    interaction:  Interaction,
+    infra:        Infra,
+}
+
+impl Skald {
+    pub async fn new(pool: Arc<SqlitePool>, config: &CoreConfig, plugins: Vec<Arc<dyn Plugin>>) -> Result<Arc<Self>> {
+        let discovered = super::agents::discover()?;
+        info!(
+            count = discovered.len(),
+            agents = discovered.iter().map(|a| a.id.as_str()).collect::<Vec<_>>().join(", "),
+            "agents discovered"
+        );
+
+        // ── Composition root: build the runtime context, then each domain bundle
+        // in dependency order. `Tasks` precedes `Tools` (tools capture cron);
+        // `Interaction` and `Conversation` come last (they need the tool registry
+        // and each other's managers).
+        let rt           = Runtime::bootstrap(pool);
+        let models       = Models::build(&rt, config).await?;
+        let media        = Media::build(&rt, &models).await?;
+        let integrations = Integrations::build(&rt, plugins);
+        let tasks        = Tasks::build(&rt, config);
+        let tools        = Tools::build(&integrations, &tasks, &models);
+        let interaction  = Interaction::build(&rt, &tools).await?;
+        let conversation = Conversation::build(&rt, &models, &media, &tools, &integrations, &interaction, config).await?;
+        let infra        = Infra::build();
+
+        // Resolve construction cycles, then start background tasks.
+        wire(&tasks, &conversation, &integrations, &interaction);
+        spawn_background(&rt, &tasks, &conversation, &integrations, config);
+
+        let skald = Arc::new(Skald {
+            rt, models, media, tools, integrations, tasks, conversation, interaction, infra,
+        });
+
+        // Inject the fully-constructed instance into the plugin manager — the one
+        // Arc<Skald> back-reference. start_enabled()/start_config_watcher() run later,
+        // from WebFrontend::start, once the router factory is wired.
+        skald.plugin_manager().set_skald(Arc::clone(&skald));
+
+        Ok(skald)
+    }
+
+    pub fn subscribe_chat_events(&self) -> tokio::sync::broadcast::Receiver<core_api::bus::BusEvent> {
+        self.rt.event_bus.subscribe()
+    }
+
+    pub fn subscribe_system_events(&self) -> tokio::sync::broadcast::Receiver<core_api::system_bus::SystemEvent> {
+        self.rt.system_bus.subscribe()
+    }
+
+    pub async fn shutdown(self: Arc<Self>) {
+        self.rt.shutdown_token.cancel();
+        self.rt.supervisor.join_all(tokio::time::Duration::from_secs(10)).await;
+        self.integrations.plugin_manager.stop_all().await;
+        // Last: every user key leaves RAM. A restarted box is opaque again until
+        // each user unlocks their own database (§9).
+        self.rt.users.lock_all().await;
+    }
+}