feat(plugins): plugin pages, per-user config, capabilities gate, mobile/telegram refactors

- Plugin HTTP routes + web pages (plugin-page-host, plugin-catalog, plugin-detail)
- Plugin access grants + per-user config (DB tables + API + frontend forms)
- Capabilities-based guard (caps.rs) replacing role-id checks
- Mobile connector: message routing, payload types, router refactor
- Telegram bot: auth flow, event handling improvements
- Honcho plugin: substantial rework
- Sidebar: plugin pages integration, role-driven visibility
- i18n: new strings for plugins, connectors, capabilities
- Remove unused mascot asset

crates/plugin-telegram-bot/src/events.rs

@@ -60,6 +60,11 @@ pub(crate) async fn spawn_forwarders_for_bound_users(
 ) {
     let bindings = shared.bindings.read().await.clone();
     for b in &bindings.bindings {
+        // Skip users whose access was revoked — don't spin up a forwarder for
+        // a chat the bot will refuse to serve anyway (inbound is gated too).
+        if !shared.user_authorized(&b.user_id).await {
+            continue;
+        }
         if let Some(handle) = shared.user_channel.resolve_user(&b.user_id).await {
             ensure_forwarder(bot.clone(), Arc::clone(shared), &b.user_id, b.chat_id, handle, cancel.clone()).await;
         }