feat(plugins): console-hosted plugin UI surface (host registry + SDK servePluginUi + console proxy/nav)

Implements planning/design/plugin-ui-surface.md (U1-U3):

- host: in-memory lease-based plugin registry (mgmt/plugins.rs) — PUT/GET/DELETE
  /api/v1/plugins + GET /plugins/{id}/ui-credential; bearer+loopback only (not on
  the mTLS read-only allowlist); plugins.changed event; port-only registration
  (proxy always dials 127.0.0.1); secret never in the listing.
- sdk: servePluginUi — loopback ephemeral bind + per-boot secret + constant-time
  check + /__health + static/SPA-fallback + register/renew(30s)/deregister via
  pf.request (skew-proof, D7). Example + tests.
- console: /plugin-ui/{id}/** reverse proxy (server-side secret injection, cookie
  strip, SSE streaming, stale-secret 401-retry) + credential cache; BFF denylist
  for the credential endpoint; dynamic Plugins nav (desktop + mobile) fed by a
  polled list; iframe-in-shell page with health probe, offline card, open-in-tab,
  deep-link sync. Dev-mode /plugin-ui middleware in vite.config.ts.

OpenAPI regen for the new endpoints follows in the next commit (built on Linux).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/events.rs

@@ -164,6 +164,12 @@ pub enum EventKind {
         /// API (RFC §8) lands.
         source: String,
     },
+    #[serde(rename = "plugins.changed")]
+    PluginsChanged {
+        /// The plugin whose registration changed (registered, restarted, deregistered, or
+        /// lease-expired). A consumer re-reads `GET /api/v1/plugins` for the new set.
+        id: String,
+    },
     #[serde(rename = "host.started")]
     HostStarted {
         version: String,
@@ -190,6 +196,7 @@ impl EventKind {
             EventKind::DisplayCreated { .. } => "display.created",
             EventKind::DisplayReleased { .. } => "display.released",
             EventKind::LibraryChanged { .. } => "library.changed",
+            EventKind::PluginsChanged { .. } => "plugins.changed",
             EventKind::HostStarted { .. } => "host.started",
             EventKind::HostStopping => "host.stopping",
         }
@@ -495,6 +502,19 @@ mod tests {
             serde_json::to_string(&ev).unwrap(),
             r#"{"seq":2,"ts_ms":1700000000000,"schema":1,"kind":"host.stopping"}"#
         );
+
+        let ev = HostEvent {
+            seq: 3,
+            ts_ms: 1_700_000_000_000,
+            schema: 1,
+            kind: EventKind::PluginsChanged {
+                id: "rom-manager".into(),
+            },
+        };
+        assert_eq!(
+            serde_json::to_string(&ev).unwrap(),
+            r#"{"seq":3,"ts_ms":1700000000000,"schema":1,"kind":"plugins.changed","id":"rom-manager"}"#
+        );
     }
 
     #[test]