feat(plugins): plugin pages, per-user config, capabilities gate, mobile/telegram refactors

- Plugin HTTP routes + web pages (plugin-page-host, plugin-catalog, plugin-detail)
- Plugin access grants + per-user config (DB tables + API + frontend forms)
- Capabilities-based guard (caps.rs) replacing role-id checks
- Mobile connector: message routing, payload types, router refactor
- Telegram bot: auth flow, event handling improvements
- Honcho plugin: substantial rework
- Sidebar: plugin pages integration, role-driven visibility
- i18n: new strings for plugins, connectors, capabilities
- Remove unused mascot asset

crates/core-api/src/memory.rs

@@ -18,7 +18,11 @@ pub trait Memory: Send + Sync {
 
     /// Retrieves context for the upcoming turn to inject into the system prompt.
     /// Returns `None` on cold start, backend down, or nothing useful available.
-    async fn query_context(&self, session_id: i64, user_message: &str) -> Option<String>;
+    ///
+    /// `user_id` is the session owner: multi-user backends scope retrieval to that
+    /// user's own memory (e.g. their Honcho peer), and `session_id` is local to
+    /// that user's pool so it must be namespaced by `user_id` to stay unique.
+    async fn query_context(&self, user_id: &str, session_id: i64, user_message: &str) -> Option<String>;
 
     /// Optional LLM-callable tools exposed by this backend (e.g. `memory_query`).
     /// Called per turn — added to the live tool list and dispatched before the