feat(plugins): plugin pages, per-user config, capabilities gate, mobile/telegram refactors

- Plugin HTTP routes + web pages (plugin-page-host, plugin-catalog, plugin-detail)
- Plugin access grants + per-user config (DB tables + API + frontend forms)
- Capabilities-based guard (caps.rs) replacing role-id checks
- Mobile connector: message routing, payload types, router refactor
- Telegram bot: auth flow, event handling improvements
- Honcho plugin: substantial rework
- Sidebar: plugin pages integration, role-driven visibility
- i18n: new strings for plugins, connectors, capabilities
- Remove unused mascot asset

crates/core-api/src/plugin.rs

@@ -17,10 +17,46 @@ use crate::secrets::SecretsApi;
 use crate::transcribe::{TranscribeProvider, TranscribeRegistry};
 use crate::tts::{TtsProvider, TtsRegistry};
 use crate::user_channel::UserChannelApi;
+use crate::user_plugin_config::PluginUserConfigApi;
 
 /// Closure that builds a fresh Axum router (e.g. for the mesh-facing server).
 pub type RouterFactory = Arc<dyn Fn() -> axum::Router + Send + Sync>;
 
+/// The authenticated caller behind a plugin-router request.
+///
+/// The frontend's auth layer injects this into request extensions for every
+/// gated request (alongside its own richer, bin-private `AuthUser`). A plugin
+/// router cannot name bin-crate types, so this is how a plugin handler learns
+/// *who* is calling — e.g. to bind a freshly paired device to the admin who
+/// opened the pairing window. Gate admin-only actions with
+/// [`crate::user_channel::UserChannelApi::plugin_access`] (which returns `true`
+/// only for admins when the plugin `manages_own_access`).
+#[derive(Clone, Debug)]
+pub struct Caller {
+    pub user_id: String,
+}
+
+/// A web UI page contributed by a plugin — see [`Plugin::web_pages`].
+#[derive(Debug, Clone)]
+pub struct PluginPage {
+    /// Stable id, unique within the plugin — used in the route
+    /// (`#plugin/<plugin_id>/<page_id>`). e.g. "pairing", "devices".
+    pub page_id:    &'static str,
+    /// Menu label. Shown as-is (the plugin owns its UI strings).
+    pub title:      String,
+    /// Bootstrap Icons name (e.g. "qr-code", "phone"), rendered as `bi-<icon>`.
+    pub icon:       &'static str,
+    /// Path of the page's ES module **inside this plugin's router**, e.g.
+    /// "web/pairing.js" — served at `/api/plugin/<id>/web/pairing.js`.
+    pub entry:      String,
+    /// `true` = only the built-in admin role sees the menu entry (e.g. a
+    /// pairing/devices console). `false` = any user with `plugin_access`.
+    pub admin_only: bool,
+    /// Menu ordering — ascending; the native menu will adopt the same field
+    /// when it is reworked. Use round numbers (10, 20, …) to leave room.
+    pub priority:   i32,
+}
+
 /// All deps a plugin may need — passed to [`Plugin::start`] and [`Plugin::reload`].
 ///
 /// Fields are `Arc<dyn Trait>` sourced from `core-api`.  Plugins use only the
@@ -51,6 +87,9 @@ pub struct PluginContext {
     /// (Telegram, mobile, …) look up an unlocked user's chat hub, approval
     /// manager and event stream by user id.
     pub user_channel:            Arc<dyn UserChannelApi>,
+    /// Per-user plugin configuration store (`plugin_user_configs` table).
+    /// Admin-readable — never secrets.
+    pub user_config:             Arc<dyn PluginUserConfigApi>,
     pub web_port:                u16,
     pub remote_slot:             Arc<RwLock<Option<Arc<dyn RemoteAccess>>>>,
     pub router_factory:          RouterFactory,
@@ -70,6 +109,30 @@ pub trait Plugin: Send + Sync {
     /// JSON Schema describing the plugin's config fields.
     fn config_schema(&self) -> Value { serde_json::json!({}) }
 
+    /// JSON Schema describing the plugin's *per-user* config fields (e.g.
+    /// Telegram's pairing code). Empty schema (the default) = the plugin has
+    /// no per-user settings and does not appear as configurable in the user
+    /// UI. Values are stored admin-readable in `system.db` — never secrets.
+    fn user_config_schema(&self) -> Value { serde_json::json!({}) }
+
+    /// Applies a per-user config submission. The default just stores the blob
+    /// in the generic store; plugins that need validation or a side effect
+    /// (e.g. Telegram turning a pairing code into a chat binding) override it
+    /// and may store a sanitized status blob for the UI via `ctx.user_config`.
+    async fn update_user_config(&self, user_id: &str, config: Value, ctx: &PluginContext) -> Result<()> {
+        ctx.user_config.set(self.id(), user_id, config).await
+    }
+
+    /// Whether the plugin decides *who may use it* through its own binding /
+    /// pairing lifecycle rather than the generic `plugin_access` grants — e.g.
+    /// the mobile connector, whose access is the admin-mediated device→user
+    /// binding (§13). When `true`, the admin Plugins UI suppresses the "User
+    /// access" checklist (it would control nothing) and the plugin never appears
+    /// in a user's "My plugins" view. Default `false`: access is the admin's
+    /// per-user `plugin_access` grant (as Telegram uses — its grant gates the
+    /// bot at runtime even though pairing is self-service).
+    fn manages_own_access(&self) -> bool { false }
+
     /// Called whenever the enabled flag or config changes — including at startup.
     /// The plugin is responsible for diffing state and restarting only what changed.
     async fn reload(&self, enabled: bool, config: Value, ctx: PluginContext) -> Result<()>;
@@ -82,11 +145,40 @@ pub trait Plugin: Send + Sync {
 
     /// Optional Axum router contributed by the plugin. When `Some`, the main
     /// `WebFrontend` nests it under `/api/plugin/<id>/` behind Skald's normal
-    /// auth (plugin.md §12.3). The router must close over the plugin's own state
-    /// (it receives no `State`). Default: no routes — existing plugins are
-    /// unaffected.
+    /// auth plus a runtime enabled-gate: **every** plugin router is mounted at
+    /// boot, and a disabled plugin's routes answer 404 until it is enabled
+    /// (no restart needed).
+    ///
+    /// Contract:
+    /// - Building the router must be cheap and safe even if the plugin never
+    ///   starts — it is called at boot regardless of the enabled flag. Handlers
+    ///   must tolerate the not-running state (an enabled-but-crashed plugin can
+    ///   still receive requests). Resolve runtime state per request through a
+    ///   shared cell (e.g. `Arc<Mutex<Option<State>>>`) rather than capturing it.
+    /// - The router closes over the plugin's own state (it receives no `State`).
+    /// - Page fragments and other assets are served from here too; responses
+    ///   automatically get `Cache-Control: no-cache` from the shell.
+    ///
+    /// Default: no routes — existing plugins are unaffected.
     fn http_router(&self) -> Option<axum::Router> { None }
 
+    /// Web UI pages this plugin contributes to the frontend, surfaced as menu
+    /// entries and served to the browser by `GET /api/plugins/pages`.
+    ///
+    /// Each page is a self-contained ES module served by this plugin's own
+    /// [`Plugin::http_router`] at `entry` (e.g. `web/pairing.js` →
+    /// `/api/plugin/<id>/web/pairing.js`). Fragment contract:
+    /// - default-export an `HTMLElement` class (a Lit element works); the host
+    ///   registers it as a custom element and sets the `plugin-id` attribute;
+    /// - the fragment talks to its own backend only through
+    ///   `/api/plugin/<id>/…` — no host APIs are injected;
+    /// - it runs with the full privileges of the logged-in session (plugins are
+    ///   trusted — they ship in the binary);
+    /// - it carries its own UI strings (reads the locale from `/api/auth/me`).
+    ///
+    /// Default: no pages.
+    fn web_pages(&self) -> Vec<PluginPage> { Vec::new() }
+
     /// Tools this plugin contributes to the registry — the sibling of
     /// [`Plugin::http_router`].
     ///