feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

src/frontend/api/agents.rs

@@ -1,15 +1,15 @@
 use axum::{Json, extract::State, response::IntoResponse};
 use serde::Serialize;
 
-use crate::core::agents::AgentMeta;
-use crate::core::llm::{LlmModelInfo, sort_models_for_agent};
+use skald_core::agents::AgentMeta;
+use skald_core::llm::{LlmModelInfo, sort_models_for_agent};
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 
 use super::ApiError;
 
 pub async fn list(_: State<Arc<Skald>>) -> Result<Json<Vec<AgentMeta>>, ApiError> {
-    let agents = crate::core::agents::discover()?;
+    let agents = skald_core::agents::discover()?;
     Ok(Json(agents))
 }
 
@@ -24,8 +24,8 @@ pub async fn get(
     State(skald): State<Arc<Skald>>,
     axum::extract::Path(id): axum::extract::Path<String>,
 ) -> Result<Json<AgentDetail>, ApiError> {
-    let meta   = crate::core::agents::load_meta(&id)?;
-    let prompt = crate::core::agents::load_prompt(&id)?;
+    let meta   = skald_core::agents::load_meta(&id)?;
+    let prompt = skald_core::agents::load_prompt(&id)?;
     let all    = skald.manager().llm_manager().list_models_info().await;
     let models = sort_models_for_agent(all, meta.scope.as_deref(), meta.strength);
     Ok(Json(AgentDetail { meta, prompt, models }))
@@ -35,7 +35,7 @@ pub async fn get(
 pub async fn icon(
     axum::extract::Path(id): axum::extract::Path<String>,
 ) -> Result<impl IntoResponse, ApiError> {
-    let meta = crate::core::agents::load_meta(&id)?;
+    let meta = skald_core::agents::load_meta(&id)?;
     let icon_path = meta.icon.ok_or_else(|| {
         ApiError::not_found(format!("Agent '{}' has no icon configured", id))
     })?;

src/frontend/api/approval.rs

@@ -5,11 +5,11 @@ use axum::{
 use serde::Deserialize;
 use serde_json::{Value, json};
 
-use crate::core::approval::NewApprovalRule;
-use crate::core::tool_catalog::{AllTools, McpServerMeta, ToolInfo};
+use skald_core::approval::NewApprovalRule;
+use skald_core::tool_catalog::{AllTools, McpServerMeta, ToolInfo};
 use std::collections::HashSet;
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 
 use super::ApiError;
 
@@ -110,7 +110,7 @@ pub async fn list_tools(
     State(skald): State<Arc<Skald>>,
 ) -> Result<Json<AllTools>, ApiError> {
     let mut tools = skald.catalog().list_all();
-    let server_rows = crate::core::db::mcp_servers::all(skald.db()).await?;
+    let server_rows = skald_core::db::mcp_servers::all(skald.db()).await?;
     tools.mcp_servers = server_rows.into_iter()
         .map(|r| (r.name, McpServerMeta { friendly_name: r.friendly_name, description: r.description }))
         .collect();
@@ -121,7 +121,7 @@ pub async fn list_tools(
     // is what makes them configurable in the Security-groups grid. Names already
     // known as built-in or MCP tools are deduped out; the rest are grouped under
     // the "dynamic" category.
-    let discovered = crate::core::db::known_tools::all(skald.db()).await?;
+    let discovered = skald_core::db::known_tools::all(skald.db()).await?;
     let existing: HashSet<&str> = tools.built_in.iter()
         .chain(tools.mcp.iter())
         .map(|t| t.name.as_str())

src/frontend/api/commands.rs

@@ -4,7 +4,7 @@ use axum::{Json, extract::State};
 
 use core_api::command::{CommandApi, CommandInfo};
 
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 
 /// `GET /api/commands` — list enabled custom slash commands (name + description)
 /// for the composer autocomplete and the dynamic `/help`. Read-only: commands are

src/frontend/api/config.rs

@@ -11,7 +11,7 @@ use serde_json::{Value, json};
 use core_api::PropertyType;
 use core_api::system_bus::SystemEvent;
 
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 // ── Response types ─────────────────────────────────────────────────────────────

src/frontend/api/cron.rs

@@ -5,9 +5,9 @@ use axum::{
 };
 use serde::Deserialize;
 
-use crate::core::db::{scheduled_jobs, job_runs};
+use skald_core::db::{scheduled_jobs, job_runs};
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 #[derive(serde::Serialize)]
@@ -80,7 +80,7 @@ pub async fn set_run_context(
     State(skald): State<Arc<Skald>>,
     Json(body): Json<SetRunContextBody>,
 ) -> Result<(), ApiError> {
-    use crate::core::run_context::RunContext;
+    use skald_core::run_context::RunContext;
     let json = body.security_group.as_ref().map(|sg| {
         RunContext::with_security_group(Some(sg.clone())).to_db()
     });

src/frontend/api/dev.rs

@@ -6,7 +6,7 @@ use axum::{
 use serde::{Deserialize, Serialize};
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 const KEY: &str = "DEBUG_MODE";

src/frontend/api/file_watch.rs

@@ -61,8 +61,8 @@ use serde_json::json;
 use tokio::sync::mpsc;
 use tracing::info;
 
-use crate::core::skald::Skald;
-use crate::core::tools::fs as fs_tools;
+use skald_core::skald::Skald;
+use skald_core::tools::fs as fs_tools;
 
 pub async fn handler(
     ws: WebSocketUpgrade,

src/frontend/api/files.rs

@@ -9,9 +9,9 @@ use axum::{
 use serde::{Deserialize, Serialize};
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
-use crate::core::latex::CompileError;
-use crate::core::tools::fs as fs_tools;
+use skald_core::skald::Skald;
+use skald_core::latex::CompileError;
+use skald_core::tools::fs as fs_tools;
 use super::ApiError;
 
 #[derive(Serialize)]
@@ -59,7 +59,7 @@ pub struct FileQuery {
 /// frontend file viewer reads text via `res.text()` and binaries via `res.blob()`.
 ///
 /// With `?compile-latex=true` a `.tex` source is compiled to PDF (see
-/// [`crate::core::latex::LatexCompiler`]); the response is then
+/// [`skald_core::latex::LatexCompiler`]); the response is then
 /// `application/pdf`. Compilation failures yield `422 Unprocessable Entity`
 /// with the textual `latexmk` log in the body, so the caller can fall back to
 /// showing the raw source.

src/frontend/api/image_generate_models.rs

@@ -1,9 +1,9 @@
 use axum::{Json, extract::State, http::StatusCode};
 use serde::Deserialize;
 
-use crate::core::image_generate::{ImageGenerateModelInfo, ImageGenerateModelRecord};
+use skald_core::image_generate::{ImageGenerateModelInfo, ImageGenerateModelRecord};
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 // ── GET /api/image-generate/models ───────────────────────────────────────────

src/frontend/api/images.rs

@@ -6,7 +6,7 @@ use axum::{
 use tokio::fs;
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 
 /// GET /api/images/:task_id
 ///

src/frontend/api/inbox.rs

@@ -7,7 +7,7 @@ use serde_json::{Value, json};
 use std::time::Duration;
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 // ── GET /api/inbox ────────────────────────────────────────────────────────────

src/frontend/api/llm.rs

@@ -4,11 +4,11 @@ use axum::{Json, extract::State, http::StatusCode};
 use serde::{Deserialize, Serialize};
 
 use crate::config::LlmStrength;
-use crate::core::llm::providers::RemoteLlmModelInfo;
-use crate::core::llm::{LlmModelInfo, LlmModelRecord, LlmProviderInfo, LlmProviderRecord};
-use crate::core::provider::{ProviderUiMeta, ReasoningMode};
+use skald_core::llm::providers::RemoteLlmModelInfo;
+use skald_core::llm::{LlmModelInfo, LlmModelRecord, LlmProviderInfo, LlmProviderRecord};
+use skald_core::provider::{ProviderUiMeta, ReasoningMode};
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 // ── GET /api/llm/providers/{id}/models ───────────────────────────────────────

src/frontend/api/mcp.rs

@@ -3,7 +3,7 @@ use axum::extract::State;
 use serde_json::Value;
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 
 /// Returns the list of running MCP servers and their available tools.
 pub async fn list_servers(State(skald): State<Arc<Skald>>) -> Json<Vec<Value>> {

src/frontend/api/mcp_media.rs

@@ -6,8 +6,8 @@ use axum::{
 use tokio::fs;
 
 use std::sync::Arc;
-use crate::core::mcp::content_type_for_ext;
-use crate::core::skald::Skald;
+use skald_core::mcp::content_type_for_ext;
+use skald_core::skald::Skald;
 
 /// GET /api/mcp-media/:file
 ///

src/frontend/api/mod.rs

@@ -34,7 +34,7 @@ use axum::{
     routing::{delete, get, patch, post, put},
 };
 
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 
 pub fn router() -> Router<Arc<Skald>> {
     Router::new()

src/frontend/api/plugins.rs

@@ -7,7 +7,7 @@ use serde::Deserialize;
 use serde_json::Value;
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 pub async fn list(State(skald): State<Arc<Skald>>) -> Result<impl IntoResponse, ApiError> {

src/frontend/api/projects.rs

@@ -7,10 +7,10 @@ use axum::{
 };
 use serde::{Deserialize, Serialize};
 
-use crate::core::db::project_tickets::ProjectTicket;
-use crate::core::db::projects::Project;
-use crate::core::run_context::RunContext;
-use crate::core::skald::Skald;
+use skald_core::db::project_tickets::ProjectTicket;
+use skald_core::db::projects::Project;
+use skald_core::run_context::RunContext;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 /// Source-id prefix for a project's interactive chat session (e.g. `project-42`).
@@ -274,7 +274,7 @@ pub async fn provisioning_for_source(
     let project = skald.projects().get(id).await?
         .ok_or_else(|| ApiError::not_found(format!("project {id} not found")))?;
     let base = project.run_context.as_deref().and_then(RunContext::from_db);
-    let rc = crate::core::projects::build_runtime_run_context(&project, base);
+    let rc = skald_core::projects::build_runtime_run_context(&project, base);
     Ok((PROJECT_COORDINATOR_AGENT.to_string(), Some(rc)))
 }
 

src/frontend/api/run_context.rs

@@ -8,7 +8,7 @@ use axum::{
 use serde::Deserialize;
 use serde_json::{Value, json};
 
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 // ── Tool Permission Groups ────────────────────────────────────────────────────
@@ -88,7 +88,7 @@ pub struct SessionPath { pub session_id: i64 }
 pub async fn set_session_run_context(
     State(skald): State<Arc<Skald>>,
     Path(p): Path<SessionPath>,
-    Json(ctx): Json<Option<crate::core::run_context::RunContext>>,
+    Json(ctx): Json<Option<skald_core::run_context::RunContext>>,
 ) -> Result<Json<Value>, ApiError> {
     skald.run_context_manager().set_session_run_context(p.session_id, ctx.as_ref()).await?;
 

src/frontend/api/sessions.rs

@@ -10,13 +10,13 @@ use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 use sqlx::SqlitePool;
 
-use crate::core::db::{chat_history, chat_llm_tools, chat_sessions, chat_sessions_stack, sources};
-use crate::core::db::chat_sessions_stack::SessionStack;
+use skald_core::db::{chat_history, chat_llm_tools, chat_sessions, chat_sessions_stack, sources};
+use skald_core::db::chat_sessions_stack::SessionStack;
 use std::sync::Arc;
-use crate::core::skald::Skald;
-use crate::core::session::handler::ApprovalDecision;
-use crate::core::approval::ApprovalManager;
-use crate::core::tools::{ToolRegistry, ToolDescriptionLength, tool_names as tn};
+use skald_core::skald::Skald;
+use skald_core::session::handler::ApprovalDecision;
+use skald_core::approval::ApprovalManager;
+use skald_core::tools::{ToolRegistry, ToolDescriptionLength, tool_names as tn};
 
 use super::ApiError;
 

src/frontend/api/stats.rs

@@ -6,7 +6,7 @@ use axum::{
 use serde::{Deserialize, Serialize};
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 #[derive(Deserialize, Default)]

src/frontend/api/transcribe_audio.rs

@@ -6,7 +6,7 @@ use axum::{
 use serde::Serialize;
 
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 #[derive(Serialize)]

src/frontend/api/transcribe_models.rs

@@ -1,9 +1,9 @@
 use axum::{Json, extract::State, http::StatusCode};
 use serde::Deserialize;
 
-use crate::core::transcribe::{RemoteTranscribeModelInfo, TranscribeModelInfo, TranscribeModelRecord};
+use skald_core::transcribe::{RemoteTranscribeModelInfo, TranscribeModelInfo, TranscribeModelRecord};
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 // ── GET /api/transcribe/models ────────────────────────────────────────────────

src/frontend/api/tts_models.rs

@@ -1,9 +1,9 @@
 use axum::{Json, extract::State, http::StatusCode};
 use serde::Deserialize;
 
-use crate::core::tts::{RemoteTtsModelInfo, TtsModelInfo, TtsModelRecord};
+use skald_core::tts::{RemoteTtsModelInfo, TtsModelInfo, TtsModelRecord};
 use std::sync::Arc;
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 use super::ApiError;
 
 // ── GET /api/tts/models ───────────────────────────────────────────────────────

src/frontend/api/uploads.rs

@@ -9,8 +9,8 @@ use tokio::io::AsyncWriteExt;
 
 use core_api::message_meta::Attachment;
 
-use crate::core::skald::Skald;
-use crate::core::tools::fs as fs_tools;
+use skald_core::skald::Skald;
+use skald_core::tools::fs as fs_tools;
 use super::ApiError;
 use super::sessions::SourcePath;
 

src/frontend/api/ws.rs

@@ -12,9 +12,9 @@ use serde_json::Value;
 use tokio::sync::broadcast;
 use tracing::{debug, info, warn};
 
-use crate::core::chat_hub::{ModelCommandOutcome, SendMessageOptions};
-use crate::core::events::{ClientMessage, ServerEvent};
-use crate::core::skald::Skald;
+use skald_core::chat_hub::{ModelCommandOutcome, SendMessageOptions};
+use skald_core::events::{ClientMessage, ServerEvent};
+use skald_core::skald::Skald;
 use core_api::command::CommandApi;
 
 #[derive(Deserialize)]
@@ -359,7 +359,7 @@ async fn handle_socket(mut socket: WebSocket, skald: Arc<Skald>, source: String)
                     // viewer. Injected here (not in the registry) so it exists only
                     // for ws.rs clients (web + mobile), never for the Telegram plugin.
                     interface_tools: vec![
-                        crate::core::tools::show_file::make_tool(
+                        skald_core::tools::show_file::make_tool(
                             Arc::clone(skald.chat_hub()),
                             source.clone(),
                         ),
@@ -418,7 +418,7 @@ fn is_resume_msg(text: &str) -> bool {
 /// Returns true if the message was an approval/rejection (caller should `continue`).
 async fn handle_approval_msg(
     text:      &str,
-    chat_hub:  &Arc<crate::core::chat_hub::ChatHub>,
+    chat_hub:  &Arc<skald_core::chat_hub::ChatHub>,
 ) -> bool {
     let Ok(v) = serde_json::from_str::<Value>(text) else { return false };
     let Some(request_id) = v["request_id"].as_i64() else { return false };
@@ -445,7 +445,7 @@ async fn handle_approval_msg(
 /// Returns true if the message was a question answer (caller should `continue`).
 async fn handle_question_answer_msg(
     text:    &str,
-    handler: &Arc<crate::core::session::handler::ChatSessionHandler>,
+    handler: &Arc<skald_core::session::handler::ChatSessionHandler>,
 ) -> bool {
     let Ok(v) = serde_json::from_str::<Value>(text) else { return false };
     if v["type"].as_str() != Some("answer_question") { return false }
@@ -462,7 +462,7 @@ async fn handle_question_answer_msg(
 async fn handle_select_client_msg(
     text:     &str,
     source:   &str,
-    chat_hub: &Arc<crate::core::chat_hub::ChatHub>,
+    chat_hub: &Arc<skald_core::chat_hub::ChatHub>,
 ) -> bool {
     let Ok(v) = serde_json::from_str::<Value>(text) else { return false };
     if v["type"].as_str() != Some("select_client") { return false }
@@ -482,7 +482,7 @@ fn handle_data_msg(text: &str, skald: &Arc<Skald>) -> bool {
     let Ok(v) = serde_json::from_str::<Value>(text) else { return false };
     if v["type"].as_str() != Some("data") { return false }
 
-    let Ok(msg) = serde_json::from_value::<crate::core::events::InboundDataMessage>(v) else {
+    let Ok(msg) = serde_json::from_value::<skald_core::events::InboundDataMessage>(v) else {
         return true;
     };
 
@@ -495,7 +495,7 @@ fn handle_data_msg(text: &str, skald: &Arc<Skald>) -> bool {
             if let (Some(lat), Some(lng)) = (lat, lng) {
                 skald.location_manager().update(
                     "remote",
-                    crate::core::location::GpsCoord { latitude: lat, longitude: lng },
+                    skald_core::location::GpsCoord { latitude: lat, longitude: lng },
                     acc,
                     live,
                 );

src/frontend/api/ws_session.rs

@@ -10,7 +10,7 @@ use axum::{
 use tokio::sync::broadcast;
 use tracing::{info, warn};
 
-use crate::core::skald::Skald;
+use skald_core::skald::Skald;
 
 pub async fn handler(
     ws:           WebSocketUpgrade,