feat(mobile): per-user device bindings, multi-user Inbox routing, and admin-mediated authorization

- Device→user bindings persisted in config table (auth.rs), loaded at plugin start
- RelayApp now routes Inbox responses per-user via UserChannelApi, never globally
- New mobile_bind_device LLM tool for admin-mediated device→user assignment
- Per-user event forwarders (events.rs) with per-user debounced notifiers
- Config listener (auth::config_listener) refreshes bindings cache reactively
- Reconcile loop catches users who unlock after boot
- Hello/Logout treated as device-registry ops (no user resolution needed)
- Unbound device payloads are silently dropped
- RelayAgent::authorize_client → bind_device (atomic bind + authorize)
- Approval rules seed mobile_bind_device/revoke_device as require

Cargo.toml

@@ -9,6 +9,7 @@ members = [
     "crates/mcp-client",
     "crates/plugin-tailscale-remote",
     "crates/plugin-telegram-bot",
+    "crates/plugin-mobile-connector",
     "crates/plugin-transcribe-whisper-local",
     "crates/plugin-comfyui",
     "crates/plugin-tts-orpheus-3b",
@@ -83,6 +84,7 @@ core-api                 = { path = "crates/core-api" }
 mcp-client               = { path = "crates/mcp-client" }
 plugin-tailscale-remote          = { path = "crates/plugin-tailscale-remote" }
 plugin-telegram-bot              = { path = "crates/plugin-telegram-bot" }
+plugin-mobile-connector          = { path = "crates/plugin-mobile-connector" }
 plugin-transcribe-whisper-local  = { path = "crates/plugin-transcribe-whisper-local", optional = true }
 plugin-comfyui                   = { path = "crates/plugin-comfyui" }
 plugin-tts-orpheus-3b            = { path = "crates/plugin-tts-orpheus-3b" }