fix: address CodeRabbit review findings across plugin system

- plugin_manager.py: clear plugin_manifests/plugin_directories before update
  to prevent ghost entries for uninstalled plugins persisting across scans
- state_reconciliation.py: remove 'enabled' key check that skipped legacy
  plugin configs, default to enabled=True matching PluginManager.load_plugin
- app.py: add threading.Lock around reconciliation start guard to prevent
  race condition spawning duplicate threads; add -> None return annotation
- store_manager.py: use resolved registry ID (alt_id) instead of original
  plugin_id when reinstalling during monorepo migration
- base.html: check Response.ok in loadPluginsDirect fallback; trigger
  fallback on tab click when HTMX unavailable; remove active-tab check
  from 5-second timeout so content preloads regardless

Skipped: api_v3.py secret redaction suggestion — the caller at line 2539
already tries schema-based mask_secret_fields() before falling back to
_conservative_mask_config, making the suggested change redundant.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/plugin_system/plugin_manager.py

@@ -136,11 +136,14 @@ class PluginManager:
         except (OSError, PermissionError) as e:
             self.logger.error("Error scanning directory %s: %s", directory, e, exc_info=True)
 
-        # Update shared state under lock
+        # Replace shared state under lock so uninstalled plugins don't linger
         with self._discovery_lock:
+            self.plugin_manifests.clear()
             self.plugin_manifests.update(new_manifests)
             if not hasattr(self, 'plugin_directories'):
                 self.plugin_directories = {}
+            else:
+                self.plugin_directories.clear()
             self.plugin_directories.update(new_directories)
 
         return plugin_ids