feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/tools/show_file.rs

@@ -0,0 +1,79 @@
+use std::sync::Arc;
+
+use serde_json::{Value, json};
+
+use crate::chat_hub::ChatHub;
+use crate::events::{GlobalEvent, ServerEvent};
+use crate::session::handler::{InterfaceTool, ToolFuture};
+use crate::tools::fs;
+use crate::tools::tool_names::SHOW_FILE_TO_USER;
+
+/// Build a `show_file_to_user` InterfaceTool bound to a `ChatHub` and a source.
+///
+/// Injected only for SPA clients (web copilot + mobile) at the WebSocket entry
+/// point, so Telegram — which has its own `send_attachment` — never sees it.
+///
+/// When called, it emits a `ServerEvent::OpenFile` to the source's connected
+/// clients. The frontend routes it: HTML opens in a new browser tab, everything
+/// else (Markdown / code / raster images / SVG / PDF / LaTeX — which is compiled
+/// to PDF server-side) opens in the file-viewer page.
+pub fn make_tool(hub: Arc<ChatHub>, source: String) -> InterfaceTool {
+    let definition = json!({
+        "type": "function",
+        "function": {
+            "name": SHOW_FILE_TO_USER,
+            "description": "Show a file to the user by opening it in their interface. \
+                             Supports Markdown, source code, plain text, raster images \
+                             (PNG/JPG/GIF/WebP/…), SVG, PDF, and LaTeX (.tex — compiled \
+                             to PDF automatically on the server). HTML files open in a \
+                             new browser tab. Use this to surface a file you created or \
+                             found so the user can look at it directly. One file per call. \
+                             The file must already exist on disk. \
+                             IMPORTANT for LaTeX: always pass the `.tex` source, never a \
+                             pre-built `.pdf` of a document you have the `.tex` for. The \
+                             `.tex` is compiled on the server and the view live-reloads \
+                             whenever any of its dependencies (\\input fragments, .sty/.cls, \
+                             images) change. A raw `.pdf` is served statically — never \
+                             recompiled and its dependencies are not watched — so the user \
+                             would keep seeing a stale render.",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "path": {
+                        "type": "string",
+                        "description": "Path of the file to show. Relative to the project root, or absolute."
+                    }
+                },
+                "required": ["path"]
+            }
+        }
+    });
+
+    let handler = Arc::new(move |args: Value| -> ToolFuture {
+        let hub    = Arc::clone(&hub);
+        let source = source.clone();
+        Box::pin(async move {
+            let path = args["path"]
+                .as_str()
+                .ok_or_else(|| anyhow::anyhow!("show_file_to_user: missing required parameter 'path'"))?;
+
+            let abs = fs::resolve(path)?;
+            if !abs.exists() {
+                anyhow::bail!("show_file_to_user: file not found: {path}");
+            }
+            if abs.is_dir() {
+                anyhow::bail!("show_file_to_user: '{path}' is a directory, not a file");
+            }
+
+            let display = fs::relativize_for_display(path);
+            hub.emit(GlobalEvent {
+                source:     Some(source),
+                session_id: None,
+                event:      ServerEvent::OpenFile { path: display.clone() },
+            });
+            Ok(format!("Opened {display} in the user's viewer."))
+        })
+    });
+
+    InterfaceTool { definition, handler }
+}