refactor(web): read plugins through a PluginCatalog; only the display runs them (#688)

The web process built its own PluginManager and loaded plugins into itself:
store installs and updates loaded or reloaded a web-side copy, and config
saves and enable/disable called on_config_change, on_enable and on_disable
on it. None of that reached the panel, and /plugins/installed reported
runtime state from those copies.

- Add PluginCatalog (src/plugin_system/plugin_catalog.py): manifests,
  directories, display modes, installed version, schema and config reads,
  with no way to run a plugin. app.py and both blueprints use it; the
  plugin_manager blueprint attribute is gone.
- Remove every lifecycle call from the web routes. Config changes already
  reach the display through ConfigService (on_config_change) and the
  enabled-set reconcile.
- Health and metrics readers move to api_v3.health_tracker /
  resource_monitor. /plugins/installed reports loaded/state/error_info as
  null (the display does not publish them) and enabled by the display's
  rule.
- Store install, update and uninstall answer restart_required when the
  running display will not pick the change up by itself
  (display_restart_required). The restart banner follows the flag via
  window.noteRestartRequired instead of the /config/main URL heuristic;
  /config/main now sends restart_required: true.
- The one remaining in-process import of plugin code (Starlark helper
  modules, oauth_flow action scripts) goes through
  _import_plugin_code_in_web_process() until a web-entry contract.
- /plugins/installed reports vegas_participation (from #682) from the
  user's setting or the manifest, with vegas_participation_source; when
  only the plugin's code decides it, null with source 'runtime', since the
  web process no longer has plugin instances to ask.
- Check & Update All keeps its restart flags when the final list refresh
  fails, and asks for a restart when an enabled plugin's first request got
  no answer and the re-sent one found it up to date.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/test_path_traversal_guards.py

@@ -132,8 +132,8 @@ class TestServePluginStatic:
             candidate = plugins / plugin_id
             return str(candidate) if candidate.exists() else None
 
-        api_v3_module.api_v3.plugin_manager = MagicMock()
-        api_v3_module.api_v3.plugin_manager.get_plugin_directory = get_plugin_directory
+        api_v3_module.api_v3.plugin_catalog = MagicMock()
+        api_v3_module.api_v3.plugin_catalog.get_plugin_directory = get_plugin_directory
         return plugins
 
     def test_a_real_plugin_file_is_still_served(
@@ -397,10 +397,13 @@ class TestPluginActionDirectory:
     '../elsewhere' ran a script from any directory holding a manifest.
     """
 
-    @pytest.fixture
-    def tree(self, tmp_path):
+    @pytest.fixture(params=["catalog", "manager"])
+    def tree(self, request, tmp_path):
+        """The web process resolves through PluginCatalog; the display
+        through PluginManager. Both apply the same rules."""
         import threading
 
+        from src.plugin_system.plugin_catalog import PluginCatalog
         from src.plugin_system.plugin_manager import PluginManager
 
         plugins = tmp_path / "plugin-repos"
@@ -415,6 +418,8 @@ class TestPluginActionDirectory:
         (outside / "s.py").write_text(
             "open(%r, 'w').write('ran')\n" % str(marker), encoding="utf-8"
         )
+        if request.param == "catalog":
+            return PluginCatalog(plugins), plugins, marker
         manager = MagicMock()
         manager.plugins_dir = plugins
         manager._discovery_lock = threading.Lock()
@@ -446,7 +451,7 @@ class TestPluginActionDirectory:
         self, api_v3_client, api_v3_module, tree
     ):
         manager, _, marker = tree
-        api_v3_module.api_v3.plugin_manager = manager
+        api_v3_module.api_v3.plugin_catalog = manager
         response = api_v3_client.post(
             "/api/v3/plugins/action",
             json={"plugin_id": "../elsewhere", "action_id": "go", "params": {}},
@@ -457,7 +462,7 @@ class TestPluginActionDirectory:
     def test_the_fallback_without_a_plugin_manager_is_guarded_too(
         self, api_v3_client, api_v3_module
     ):
-        api_v3_module.api_v3.plugin_manager = None
+        api_v3_module.api_v3.plugin_catalog = None
         response = api_v3_client.post(
             "/api/v3/plugins/action",
             json={"plugin_id": "../elsewhere", "action_id": "go", "params": {}},