Add managed local plugin lifecycle (#3222)

* feat(plugins): add local plugin surfaces and RPCs

Keep plugin execution scoped to its daemon while allowing one local TypeScript entry point to contribute validated RPCs and native client surfaces. Paseo owns host selection, navigation chrome, and per-installation query caches.

* feat(plugins): add Linear attachment source

* fix(nix): refresh npm dependency hash

* test(server): exclude internal sessions from Hub counts

* test(server): distinguish Hub execution sessions

* feat(plugins): make local plugins explicitly opt-in

Keep plugin loading dormant until configuration enables it, and collect unsupported examples under one directory.

* refactor(plugins): establish host boundaries

* fix(nix): refresh plugin dependency hash

* fix(plugins): complete packaging and startup rollback

* feat(plugins): add managed local lifecycle

Make trusted local plugins recoverable and authorable through daemon-owned lifecycle operations, host settings, and a capability-gated CLI. Reloads fully stop the previous plugin before starting new code, while generated projects provide strict TSX checking without changing runtime dependency ownership.

* fix(nix): refresh plugin dependency hash

packages/app/src/i18n/resources/en.ts

@@ -1796,8 +1796,56 @@ export const en = {
       providers: "Providers",
       usage: "Usage",
       terminals: "Terminals",
+      plugins: "Plugins",
       host: "Overview",
     },
+    plugins: {
+      title: "Plugins",
+      trustedTitle: "Plugins are trusted code",
+      trustedDescription:
+        "They run on this host and inside the app without sandboxing. Install only code you trust.",
+      globalTitle: "Enable plugins",
+      globalHint: "Global switch for every configured plugin",
+      directoryLabel: "Plugin directory",
+      directoryPlaceholder: "/absolute/path/on/host",
+      idLabel: "Plugin installation ID",
+      idHint: "Leave blank to use paseo-plugin.json",
+      idPlaceholder: "Manifest default",
+      install: "Install directory",
+      installing: "Installing…",
+      status: { running: "running", disabled: "disabled", failed: "failed" },
+      actions: {
+        reload: "Reload",
+        reloading: "Reloading…",
+        enable: "Enable",
+        enabling: "Enabling…",
+        disable: "Disable",
+        disabling: "Disabling…",
+        remove: "Remove",
+        removing: "Removing…",
+      },
+      feedback: {
+        installed: "Installed {{id}}",
+        reload: "Reloaded {{id}}",
+        enable: "Enabled {{id}}",
+        disable: "Disabled {{id}}",
+        remove: "Removed {{id}}",
+        kept: "Kept {{id}}",
+        globalEnabled: "Plugins enabled",
+        globalDisabled: "Plugins disabled",
+      },
+      removeConfirmTitle: "Remove {{id}}?",
+      removeConfirmMessage: "This removes the configuration. The source directory is not deleted.",
+      states: {
+        offlineTitle: "Plugin host is offline",
+        offlineDescription: "Reconnect to this host to manage its plugins.",
+        updateTitle: "Update this host to manage plugins",
+        loading: "Loading plugins…",
+        errorTitle: "Unable to load plugins",
+        retry: "Retry",
+        empty: "No plugins configured",
+      },
+    },
     metadataGeneration: {
       title: "Metadata generation",
       description: