feat(plugins): plugin pages, per-user config, capabilities gate, mobile/telegram refactors

- Plugin HTTP routes + web pages (plugin-page-host, plugin-catalog, plugin-detail)
- Plugin access grants + per-user config (DB tables + API + frontend forms)
- Capabilities-based guard (caps.rs) replacing role-id checks
- Mobile connector: message routing, payload types, router refactor
- Telegram bot: auth flow, event handling improvements
- Honcho plugin: substantial rework
- Sidebar: plugin pages integration, role-driven visibility
- i18n: new strings for plugins, connectors, capabilities
- Remove unused mascot asset

src/frontend/api/mcp.rs

@@ -20,22 +20,12 @@ use serde_json::{json, Value};
 use skald_core::db::{mcp_catalog, mcp_global_access, mcp_global_servers, mcp_user_servers, oauth_providers, role_capabilities};
 use skald_core::skald::Skald;
 
+use super::caps::require_cap;
 use super::guard::AuthUser;
 use super::{require_context, ApiError};
 
 // ── helpers ───────────────────────────────────────────────────────────────────
 
-/// Fails with 403 unless the caller's role holds `cap` (admin holds everything).
-async fn require_cap(skald: &Skald, user_id: &str, cap: &str) -> Result<(), ApiError> {
-    let user = skald_core::db::users::get(skald.db(), user_id).await?
-        .ok_or_else(|| ApiError::unauthorized("unknown user"))?;
-    if role_capabilities::has(skald.db(), &user.role_id, cap).await? {
-        Ok(())
-    } else {
-        Err(ApiError::forbidden(format!("your role lacks the capability `{cap}`")))
-    }
-}
-
 fn to_json_opt<T: serde::Serialize>(v: &Option<T>) -> Option<String> {
     v.as_ref().and_then(|x| serde_json::to_string(x).ok())
 }