feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/skald/wiring.rs

@@ -0,0 +1,101 @@
+//! Post-construction wiring: the `OnceLock` cycle-breakers and the background-task
+//! spawns, each concentrated in one readable place instead of being scattered
+//! through the constructor.
+
+use std::sync::Arc;
+
+use tracing::info;
+
+use crate::config::CoreConfig;
+use crate::elicitation::ElicitationBridge;
+
+use super::bundles::{Conversation, Integrations, Interaction, Tasks};
+use super::runtime::Runtime;
+
+/// Resolves the construction cycles (`cron ↔ session ↔ hub`, `ticket → cron`,
+/// `mcp → elicitation`) via the managers' `OnceLock` setters.
+pub(super) fn wire(
+    tasks: &Tasks,
+    conversation: &Conversation,
+    integrations: &Integrations,
+    interaction: &Interaction,
+) {
+    tasks.cron.set_session(Arc::clone(&conversation.manager));
+    tasks.cron.set_hub(Arc::clone(&conversation.chat_hub));
+    tasks.cron.set_self_arc(Arc::clone(&tasks.cron));
+    tasks.ticket_manager.set_task_manager(Arc::clone(&tasks.cron));
+    conversation.chat_hub.set_task_mgr(Arc::clone(&tasks.cron));
+    integrations.mcp.set_elicitation_handler(ElicitationBridge::new(Arc::clone(&interaction.elicitation)));
+    info!("ChatHub initialised");
+}
+
+/// Spawns every long-lived background task, each registered by name with the
+/// supervisor so it is joined on shutdown. MCP `initialize()` is spawned here —
+/// after `wire()` has installed the elicitation handler — so stdio servers start
+/// with a handler for server-initiated `elicitation/create` requests.
+pub(super) fn spawn_background(
+    rt: &Runtime,
+    tasks: &Tasks,
+    conversation: &Conversation,
+    integrations: &Integrations,
+    config: &CoreConfig,
+) {
+    // LLM request-log retention/cleanup — first run 1 min after startup, then 12h.
+    if let Some(cfg) = config.llm.requests_log.clone().filter(|r| r.enabled) {
+        rt.supervisor.adopt_one(
+            "llm-log-cleanup",
+            crate::db::llm_requests::cleanup::spawn(
+                Arc::clone(&rt.db),
+                cfg,
+                rt.shutdown_token.clone(),
+            ),
+        );
+    }
+
+    // Session-cancellation subscriber: fans SessionCancelled events on the system
+    // bus into cancel_session() so any in-flight turn / approval / clarification
+    // all unblock.
+    {
+        let manager_ref = Arc::clone(&conversation.manager);
+        let mut rx = rt.system_bus.subscribe();
+        let sd = rt.shutdown_token.clone();
+        rt.supervisor.spawn("session-cancel", async move {
+            loop {
+                tokio::select! {
+                    _ = sd.cancelled() => break,
+                    event = rx.recv() => match event {
+                        Ok(core_api::system_bus::SystemEvent::SessionCancelled { session_id }) => {
+                            manager_ref.cancel_session(session_id).await;
+                        }
+                        Ok(_) => {}
+                        Err(_) => break,
+                    }
+                }
+            }
+        });
+    }
+
+    // MCP servers connect in the background. `initialize()` does not itself observe
+    // the cancellation token, so race it against shutdown: on cancel the task exits
+    // promptly (dropping the in-flight connection attempts) instead of blocking the
+    // shutdown join until the deadline.
+    {
+        let mcp = Arc::clone(&integrations.mcp);
+        let sd = rt.shutdown_token.clone();
+        rt.supervisor.spawn("mcp-init", async move {
+            tokio::select! {
+                _ = sd.cancelled() => {}
+                _ = mcp.initialize() => {}
+            }
+        });
+    }
+
+    rt.supervisor.adopt("cron", Arc::clone(&tasks.cron).start(rt.shutdown_token.clone()));
+    info!("cron scheduler started");
+    rt.supervisor.adopt_one(
+        "ticket-listener",
+        Arc::clone(&tasks.ticket_manager).start_listener(Arc::clone(&rt.system_bus), rt.shutdown_token.clone()),
+    );
+    rt.supervisor.adopt_one("tic", Arc::clone(&conversation.tic_manager).start(rt.shutdown_token.clone()));
+    info!("TicManager started");
+}