feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/tools/register_mcp.rs

@@ -0,0 +1,175 @@
+use std::sync::Arc;
+
+use anyhow::Result;
+use serde_json::{Value, json};
+
+use crate::db::mcp_servers::UpsertParams;
+use crate::mcp::McpManager;
+use crate::tools::{Tool, ToolDescriptionLength};
+
+pub struct RegisterMcp {
+    mcp: Arc<McpManager>,
+}
+
+impl RegisterMcp {
+    pub fn new(mcp: Arc<McpManager>) -> Self { Self { mcp } }
+}
+
+impl Tool for RegisterMcp {
+    fn name(&self) -> &str { "register_mcp" }
+    fn category(&self) -> crate::tools::ToolCategory { crate::tools::ToolCategory::Config }
+
+    fn description(&self) -> &str {
+        "Register (or update) an MCP server and connect to it immediately. \
+         For stdio servers supply `command` and optionally `args` and `env`. \
+         For HTTP/SSE servers supply `url` and optionally `api_key`. \
+         Optionally provide `description` (what the server does) and `friendly_name` (display name for UI). \
+         Returns the list of tools exposed by the server once connected."
+    }
+
+    fn parameters_schema(&self) -> Value {
+        json!({
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "description": "Unique name for this MCP server (used to reference it in tool calls)."
+                },
+                "transport": {
+                    "type": "string",
+                    "enum": ["stdio", "http", "sse"],
+                    "description": "Connection transport. Use `stdio` for local processes, `http` for remote servers."
+                },
+                "command": {
+                    "type": "string",
+                    "description": "stdio only: executable to spawn (e.g. `npx`, `uvx`, path to binary)."
+                },
+                "args": {
+                    "type": "array",
+                    "items": { "type": "string" },
+                    "description": "stdio only: command-line arguments passed to the executable."
+                },
+                "env": {
+                    "type": "object",
+                    "additionalProperties": { "type": "string" },
+                    "description": "stdio only: extra environment variables. Values support `${VAR}` interpolation."
+                },
+                "url": {
+                    "type": "string",
+                    "description": "http/sse only: base URL of the remote MCP server."
+                },
+                "api_key": {
+                    "type": "string",
+                    "description": "http/sse only: API key sent as `Authorization: Bearer <key>`."
+                },
+                "description": {
+                    "type": "string",
+                    "description": "A short description of what this MCP server provides (shown in list_items type=mcp)."
+                },
+                "friendly_name": {
+                    "type": "string",
+                    "description": "A human-readable display name for this MCP server (e.g. 'Google Calendar')."
+                }
+            },
+            "required": ["name", "transport"]
+        })
+    }
+
+    fn describe(&self, args: &Value, _length: ToolDescriptionLength) -> String {
+        let name = args["name"].as_str().unwrap_or("?");
+        format!("register MCP `{name}`")
+    }
+
+    fn execute(&self, args: Value) -> Result<String> {
+        let name = args["name"].as_str()
+            .ok_or_else(|| anyhow::anyhow!("register_mcp: missing required argument `name`"))?;
+        let transport = args["transport"].as_str()
+            .ok_or_else(|| anyhow::anyhow!("register_mcp: missing required argument `transport`"))?;
+
+        let args_json = args["args"].as_array()
+            .map(|a| serde_json::to_string(a))
+            .transpose()?;
+        let env_json = args["env"].as_object()
+            .map(|o| serde_json::to_string(o))
+            .transpose()?;
+
+        let p = UpsertParams {
+            name,
+            transport,
+            command:       args["command"].as_str(),
+            args_json,
+            env_json,
+            url:           args["url"].as_str(),
+            api_key:       args["api_key"].as_str(),
+            description:   args["description"].as_str(),
+            friendly_name: args["friendly_name"].as_str(),
+        };
+
+        let tool_names = tokio::task::block_in_place(|| {
+            tokio::runtime::Handle::current().block_on(self.mcp.register(p))
+        })?;
+
+        Ok(format!(
+            "MCP server '{}' registered and connected. Tools: {}",
+            name,
+            if tool_names.is_empty() { "(none)".to_string() } else { tool_names.join(", ") },
+        ))
+    }
+}
+
+// ── delete_mcp ────────────────────────────────────────────────────────────────
+//
+// Destructive counterpart to `register_mcp`. Kept separate from `toggle_item`
+// (kind=mcp) for the same reason `delete_cron_job` is: toggling is reversible,
+// deletion is not, so the distinct tool can carry its own approval rule and the
+// LLM can't conflate "disable" with "remove". Both live here because both manage
+// the MCP-server lifecycle and hold only `Arc<McpManager>`.
+
+pub struct DeleteMcp {
+    mcp: Arc<McpManager>,
+}
+
+impl DeleteMcp {
+    pub fn new(mcp: Arc<McpManager>) -> Self { Self { mcp } }
+}
+
+impl Tool for DeleteMcp {
+    fn name(&self) -> &str { "delete_mcp" }
+    fn category(&self) -> crate::tools::ToolCategory { crate::tools::ToolCategory::Config }
+
+    fn description(&self) -> &str {
+        "Permanently delete (unregister) an MCP server by name: removes it from the \
+         database and disconnects it. This is irreversible — to temporarily turn a \
+         server off without losing its configuration, use \
+         `toggle_item(kind=\"mcp\", enabled=false)` instead."
+    }
+
+    fn parameters_schema(&self) -> Value {
+        json!({
+            "type": "object",
+            "required": ["name"],
+            "properties": {
+                "name": {
+                    "type": "string",
+                    "description": "Name of the MCP server to delete (from list_items type=mcp)."
+                }
+            }
+        })
+    }
+
+    fn describe(&self, args: &Value, _length: ToolDescriptionLength) -> String {
+        let name = args["name"].as_str().unwrap_or("?");
+        format!("delete MCP `{name}`")
+    }
+
+    fn execute(&self, args: Value) -> Result<String> {
+        let name = args["name"].as_str()
+            .ok_or_else(|| anyhow::anyhow!("delete_mcp: missing required argument `name`"))?;
+
+        tokio::task::block_in_place(|| {
+            tokio::runtime::Handle::current().block_on(self.mcp.unregister(name))
+        })?;
+
+        Ok(format!("MCP server '{name}' deleted and disconnected."))
+    }
+}