fix: add thread-safe locking to PluginManager and fix reconciliation retry

PluginManager thread safety:
- Add RLock protecting plugin_manifests and plugin_directories
- Build scan results locally in _scan_directory_for_plugins, then update
  shared state under lock
- Protect reads in get_plugin_info, get_all_plugin_info,
  get_plugin_directory, get_plugin_display_modes, find_plugin_for_mode
- Protect manifest mutation in reload_plugin
- Prevents races between background reconciliation thread and request
  handlers reading plugin state

Reconciliation retry:
- Clear _reconciliation_started on exception so next request retries
- Check result.reconciliation_successful before marking done
- Reset _reconciliation_started on non-success results to allow retry

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web_interface/app.py

@@ -656,7 +656,7 @@ _reconciliation_started = False
 
 def _run_startup_reconciliation():
     """Run state reconciliation in background to auto-repair missing plugins."""
-    global _reconciliation_done
+    global _reconciliation_done, _reconciliation_started
     from src.logging_config import get_logger
     _logger = get_logger('reconciliation')
 
@@ -672,11 +672,16 @@ def _run_startup_reconciliation():
         result = reconciler.reconcile_state()
         if result.inconsistencies_found:
             _logger.info("[Reconciliation] %s", result.message)
-        if result.inconsistencies_fixed:
-            plugin_manager.discover_plugins()
-        _reconciliation_done = True
+        if result.reconciliation_successful:
+            if result.inconsistencies_fixed:
+                plugin_manager.discover_plugins()
+            _reconciliation_done = True
+        else:
+            _logger.warning("[Reconciliation] Finished with unresolved issues, will retry")
+            _reconciliation_started = False
     except Exception as e:
         _logger.error("[Reconciliation] Error: %s", e, exc_info=True)
+        _reconciliation_started = False
 
 # Initialize health monitor and run reconciliation on first request
 @app.before_request