feat(plugins): fold first-party plugins in-tree; bundled + external roots

First-party plugins (host_agent, http, snmp, traefik, unifi, docker) are now
tracked under plugins/ and baked into the image, so they version atomically
with core — ending the cross-repo import drift the roundtable->steward rename
exposed. History for these files is preserved in the archived Roundtable-plugins
repo.

Plugin discovery becomes multi-root: PLUGIN_DIR (single) -> PLUGIN_DIRS
(bundled first, then external) + PLUGIN_INSTALL_DIR. Bundled ships in the image;
third-party plugins still mount at runtime into the external root
(STEWARD_PLUGIN_DIR, default /data/plugins) and downloads/installs land there.
Bundled shadows external on a name collision.

- config.py: load_bootstrap returns plugin_dirs + plugin_install_dir
- app.py: iterate PLUGIN_DIRS at the migration + load sites
- migration_runner.py: discover_all_in() unions every plugin root
- plugin_manager.py: resolve_plugin_path() (pure, first-root-wins); load /
  install / hot-reload span all roots; installs target the external root
- settings/routes.py: _discover_plugins scans all roots, dedup bundled-first
- Dockerfile: COPY plugins/ ; docker-compose: drop host bind, document external
- tests/test_plugin_dirs.py: resolution, multi-root discovery, bootstrap split

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/http/models.py

@@ -0,0 +1,63 @@
+# plugins/http/models.py
+from __future__ import annotations
+import uuid
+from datetime import datetime, timezone
+from sqlalchemy import Boolean, DateTime, Float, Integer, String, Text
+from sqlalchemy.orm import Mapped, mapped_column
+from fabledscryer.models.base import Base
+
+
+class HttpMonitor(Base):
+    """A configured HTTP endpoint to check periodically."""
+    __tablename__ = "http_monitors"
+
+    id: Mapped[str] = mapped_column(
+        String(36), primary_key=True, default=lambda: str(uuid.uuid4())
+    )
+    name: Mapped[str] = mapped_column(String(128), nullable=False)
+    url: Mapped[str] = mapped_column(String(2048), nullable=False)
+    method: Mapped[str] = mapped_column(String(8), nullable=False, default="GET")
+    expected_status: Mapped[int] = mapped_column(Integer, nullable=False, default=200)
+    # Optional substring to find in the response body (empty = skip check)
+    content_match: Mapped[str] = mapped_column(String(512), nullable=False, default="")
+    # JSON dict of extra request headers, e.g. {"Authorization": "Bearer ..."}
+    headers_json: Mapped[str] = mapped_column(Text, nullable=False, default="{}")
+    timeout_seconds: Mapped[int] = mapped_column(Integer, nullable=False, default=10)
+    # 0 = use global plugin check_interval_seconds
+    check_interval_seconds: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    follow_redirects: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    verify_ssl: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    # Updated after each check so the scheduler can compute next-run time efficiently
+    last_checked_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+    )
+
+
+class HttpResult(Base):
+    """One check result for an HttpMonitor."""
+    __tablename__ = "http_results"
+
+    id: Mapped[str] = mapped_column(
+        String(36), primary_key=True, default=lambda: str(uuid.uuid4())
+    )
+    monitor_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    checked_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        index=True,
+    )
+    status_code: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    response_ms: Mapped[float | None] = mapped_column(Float, nullable=True)
+    is_up: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    # None when no content_match is configured; True/False when it is
+    content_matched: Mapped[bool | None] = mapped_column(Boolean, nullable=True)
+    error_msg: Mapped[str | None] = mapped_column(String(512), nullable=True)
+    # TLS expiry if the endpoint is HTTPS; None for HTTP or on error
+    tls_expires_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )