feat(plugins): plugin pages, per-user config, capabilities gate, mobile/telegram refactors

- Plugin HTTP routes + web pages (plugin-page-host, plugin-catalog, plugin-detail)
- Plugin access grants + per-user config (DB tables + API + frontend forms)
- Capabilities-based guard (caps.rs) replacing role-id checks
- Mobile connector: message routing, payload types, router refactor
- Telegram bot: auth flow, event handling improvements
- Honcho plugin: substantial rework
- Sidebar: plugin pages integration, role-driven visibility
- i18n: new strings for plugins, connectors, capabilities
- Remove unused mascot asset

web/css/page-shell.css

@@ -76,6 +76,10 @@ roles-page,
 shared-folders-page,
 connectors-page,
 connector-detail-page,
+plugins-page,
+plugin-catalog-page,
+plugin-detail-page,
+plugin-page-host,
 marketplace-page,
 catalog-page,
 profile-page {
@@ -88,6 +92,18 @@ profile-page {
   border-right: 1px solid var(--toolbar-border, #e5e9f0);
 }
 
+/* Plugin-contributed page fragments mount inside the host with the `plugin-id`
+   attribute set — make them fill the host column (the host is `flex:1`, but a
+   bare custom element has no default sizing). Generic across all plugins. */
+plugin-page-host > [plugin-id] {
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  min-width: 0;
+  min-height: 0;
+  overflow: hidden;
+}
+
 /* ── Workspace placeholder ──────────────────────────────────────────────────── */
 
 .app-workspace {