feat(plugins): plugin pages, per-user config, capabilities gate, mobile/telegram refactors

- Plugin HTTP routes + web pages (plugin-page-host, plugin-catalog, plugin-detail)
- Plugin access grants + per-user config (DB tables + API + frontend forms)
- Capabilities-based guard (caps.rs) replacing role-id checks
- Mobile connector: message routing, payload types, router refactor
- Telegram bot: auth flow, event handling improvements
- Honcho plugin: substantial rework
- Sidebar: plugin pages integration, role-driven visibility
- i18n: new strings for plugins, connectors, capabilities
- Remove unused mascot asset

crates/core-api/src/bus.rs

@@ -69,6 +69,10 @@ pub struct ToolCallEvent {
 pub struct ChatEvent {
     pub session_id:     i64,
     pub stack_id:       i64,
+    /// The session owner's user id. Ids in this event (`session_id`, …) are local
+    /// to that user's pool, so consumers scoping per-user (e.g. the Honcho memory
+    /// sink) must key on `user_id` to avoid cross-user collisions.
+    pub user_id:        String,
     /// `chat_history.id` for this message.
     pub message_id:     i64,
     pub role:           ChatEventRole,