feat(mobile): per-user device bindings, multi-user Inbox routing, and admin-mediated authorization

- Device→user bindings persisted in config table (auth.rs), loaded at plugin start
- RelayApp now routes Inbox responses per-user via UserChannelApi, never globally
- New mobile_bind_device LLM tool for admin-mediated device→user assignment
- Per-user event forwarders (events.rs) with per-user debounced notifiers
- Config listener (auth::config_listener) refreshes bindings cache reactively
- Reconcile loop catches users who unlock after boot
- Hello/Logout treated as device-registry ops (no user resolution needed)
- Unbound device payloads are silently dropped
- RelayAgent::authorize_client → bind_device (atomic bind + authorize)
- Approval rules seed mobile_bind_device/revoke_device as require

src/main.rs

@@ -167,6 +167,7 @@ fn build_plugins() -> Vec<Arc<dyn Plugin>> {
     let mut plugins: Vec<Arc<dyn Plugin>> = vec![
         Arc::new(plugin_tailscale_remote::RemotePlugin::new()),
         Arc::new(plugin_telegram_bot::TelegramPlugin::new()),
+        Arc::new(plugin_mobile_connector::MobileConnectorPlugin::new()),
         Arc::new(plugin_comfyui::ComfyUIPlugin::new()),
         Arc::new(plugin_tts_orpheus_3b::OrpheusTtsPlugin::new()),
         Arc::new(plugin_tts_kokoro::KokoroTtsPlugin::new()),