refactor(web): read plugins through a PluginCatalog; only the display runs them (#688)

The web process built its own PluginManager and loaded plugins into itself:
store installs and updates loaded or reloaded a web-side copy, and config
saves and enable/disable called on_config_change, on_enable and on_disable
on it. None of that reached the panel, and /plugins/installed reported
runtime state from those copies.

- Add PluginCatalog (src/plugin_system/plugin_catalog.py): manifests,
  directories, display modes, installed version, schema and config reads,
  with no way to run a plugin. app.py and both blueprints use it; the
  plugin_manager blueprint attribute is gone.
- Remove every lifecycle call from the web routes. Config changes already
  reach the display through ConfigService (on_config_change) and the
  enabled-set reconcile.
- Health and metrics readers move to api_v3.health_tracker /
  resource_monitor. /plugins/installed reports loaded/state/error_info as
  null (the display does not publish them) and enabled by the display's
  rule.
- Store install, update and uninstall answer restart_required when the
  running display will not pick the change up by itself
  (display_restart_required). The restart banner follows the flag via
  window.noteRestartRequired instead of the /config/main URL heuristic;
  /config/main now sends restart_required: true.
- The one remaining in-process import of plugin code (Starlark helper
  modules, oauth_flow action scripts) goes through
  _import_plugin_code_in_web_process() until a web-entry contract.
- /plugins/installed reports vegas_participation (from #682) from the
  user's setting or the manifest, with vegas_participation_source; when
  only the plugin's code decides it, null with source 'runtime', since the
  web process no longer has plugin instances to ask.
- Check & Update All keeps its restart flags when the final list refresh
  fails, and asks for a restart when an enabled plugin's first request got
  no answer and the re-sent one found it up to date.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web_interface/auto_update.py

@@ -329,7 +329,7 @@ class AutoUpdater:
     """Decides when an automatic update is due and runs it."""
 
     def __init__(self, config_manager, core_update, store_manager=None,
-                 plugin_manager=None, schema_manager=None, operation_history=None,
+                 plugin_catalog=None, schema_manager=None, operation_history=None,
                  project_root=PROJECT_ROOT, state_file=None, clock=time.time,
                  restart=restart_service, run=subprocess.run,
                  service_active=_service_active, helper_ready=helper_ready,
@@ -337,7 +337,10 @@ class AutoUpdater:
         self.config_manager = config_manager
         self.core_update = core_update
         self.store_manager = store_manager
-        self.plugin_manager = plugin_manager
+        # The web process's PluginCatalog: rescanned after plugin updates.
+        # The display picks the new code up when _run_deferred_plugins
+        # restarts it.
+        self.plugin_catalog = plugin_catalog
         self.schema_manager = schema_manager
         self.operation_history = operation_history
         self.project_root = Path(project_root)
@@ -658,9 +661,9 @@ class AutoUpdater:
         for plugin_id in updated:
             if self.schema_manager:
                 self.schema_manager.invalidate_cache(plugin_id)
-        if updated and self.plugin_manager:
+        if updated and self.plugin_catalog:
             try:
-                self.plugin_manager.discover_plugins()
+                self.plugin_catalog.discover_plugins()
             except Exception:
                 logger.debug("discover_plugins after auto-update failed", exc_info=True)
         return updated, failed