refactor(web): read plugins through a PluginCatalog; only the display runs them (#688)

The web process built its own PluginManager and loaded plugins into itself:
store installs and updates loaded or reloaded a web-side copy, and config
saves and enable/disable called on_config_change, on_enable and on_disable
on it. None of that reached the panel, and /plugins/installed reported
runtime state from those copies.

- Add PluginCatalog (src/plugin_system/plugin_catalog.py): manifests,
  directories, display modes, installed version, schema and config reads,
  with no way to run a plugin. app.py and both blueprints use it; the
  plugin_manager blueprint attribute is gone.
- Remove every lifecycle call from the web routes. Config changes already
  reach the display through ConfigService (on_config_change) and the
  enabled-set reconcile.
- Health and metrics readers move to api_v3.health_tracker /
  resource_monitor. /plugins/installed reports loaded/state/error_info as
  null (the display does not publish them) and enabled by the display's
  rule.
- Store install, update and uninstall answer restart_required when the
  running display will not pick the change up by itself
  (display_restart_required). The restart banner follows the flag via
  window.noteRestartRequired instead of the /config/main URL heuristic;
  /config/main now sends restart_required: true.
- The one remaining in-process import of plugin code (Starlark helper
  modules, oauth_flow action scripts) goes through
  _import_plugin_code_in_web_process() until a web-entry contract.
- /plugins/installed reports vegas_participation (from #682) from the
  user's setting or the manifest, with vegas_participation_source; when
  only the plugin's code decides it, null with source 'runtime', since the
  web process no longer has plugin instances to ask.
- Check & Update All keeps its restart flags when the final list refresh
  fails, and asks for a restart when an enabled plugin's first request got
  no answer and the re-sent one found it up to date.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/test_api_v3_lazy_plugin_discovery.py

@@ -16,7 +16,7 @@ callers (the Home Assistant MQTT bridge, scripts) saw it after every restart.
 undiscovered plugin section skipped secret separation and wrote its API key
 into config.json in plain text.
 
-A real PluginManager over a temporary plugins directory, so "empty until
+A real PluginCatalog over a temporary plugins directory, so "empty until
 discovered" is the real behaviour rather than a mock's.
 """
 
@@ -30,7 +30,7 @@ import pytest
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
 from src.config_manager import ConfigManager  # noqa: E402
-from src.plugin_system.plugin_manager import PluginManager  # noqa: E402
+from src.plugin_system.plugin_catalog import PluginCatalog  # noqa: E402
 from src.plugin_system.schema_manager import SchemaManager  # noqa: E402
 from test._api_v3_test_helpers import api_v3_client, api_v3_module  # noqa: F401,E402
 
@@ -69,10 +69,10 @@ def plugins_dir(tmp_path):
 @pytest.fixture
 def fresh_web_process(api_v3_module, plugins_dir):
     """The web process right after a restart: nothing discovered yet."""
-    manager = PluginManager(plugins_dir=str(plugins_dir))
-    assert not manager.plugin_manifests
-    api_v3_module.api_v3.plugin_manager = manager
-    return manager
+    catalog = PluginCatalog(plugins_dir=plugins_dir)
+    assert not catalog.plugin_manifests
+    api_v3_module.api_v3.plugin_catalog = catalog
+    return catalog
 
 
 @pytest.fixture