feat(plugins): fold first-party plugins in-tree; bundled + external roots

First-party plugins (host_agent, http, snmp, traefik, unifi, docker) are now
tracked under plugins/ and baked into the image, so they version atomically
with core — ending the cross-repo import drift the roundtable->steward rename
exposed. History for these files is preserved in the archived Roundtable-plugins
repo.

Plugin discovery becomes multi-root: PLUGIN_DIR (single) -> PLUGIN_DIRS
(bundled first, then external) + PLUGIN_INSTALL_DIR. Bundled ships in the image;
third-party plugins still mount at runtime into the external root
(STEWARD_PLUGIN_DIR, default /data/plugins) and downloads/installs land there.
Bundled shadows external on a name collision.

- config.py: load_bootstrap returns plugin_dirs + plugin_install_dir
- app.py: iterate PLUGIN_DIRS at the migration + load sites
- migration_runner.py: discover_all_in() unions every plugin root
- plugin_manager.py: resolve_plugin_path() (pure, first-root-wins); load /
  install / hot-reload span all roots; installs target the external root
- settings/routes.py: _discover_plugins scans all roots, dedup bundled-first
- Dockerfile: COPY plugins/ ; docker-compose: drop host bind, document external
- tests/test_plugin_dirs.py: resolution, multi-root discovery, bootstrap split

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/snmp/poller.py

@@ -0,0 +1,94 @@
+# plugins/snmp/poller.py
+"""
+Synchronous SNMP GET helper, run via executor.
+
+Requires pysnmp-lextudio (maintained pysnmp fork):
+    pip install 'fabledscryer[snmp]'
+
+If pysnmp is not installed, poll_device() returns an empty dict and logs a warning.
+"""
+from __future__ import annotations
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+def _pysnmp_available() -> bool:
+    try:
+        import pysnmp  # noqa: F401
+        return True
+    except ImportError:
+        return False
+
+
+def _mp_model(version: str) -> int:
+    """Map version string to pysnmp mpModel integer."""
+    return 0 if version == "1" else 1
+
+
+def poll_device_sync(
+    host: str,
+    port: int,
+    community: str,
+    version: str,
+    oids: list[dict],
+) -> dict[str, float]:
+    """
+    Perform SNMP GET for each OID and return {label: float_value}.
+    Non-numeric OIDs (strings, etc.) are skipped.
+    Returns empty dict on any error.
+    """
+    if not _pysnmp_available():
+        logger.warning("pysnmp not installed — SNMP polling disabled. "
+                       "Install with: pip install 'fabledscryer[snmp]'")
+        return {}
+
+    from pysnmp.hlapi import (
+        CommunityData,
+        ContextData,
+        ObjectIdentity,
+        ObjectType,
+        SnmpEngine,
+        UdpTransportTarget,
+        getCmd,
+    )
+
+    results: dict[str, float] = {}
+    engine = SnmpEngine()
+
+    for oid_cfg in oids:
+        oid = oid_cfg["oid"]
+        label = oid_cfg.get("label") or oid
+        scale = float(oid_cfg.get("scale", 1.0))
+
+        try:
+            error_indication, error_status, error_index, var_binds = next(
+                getCmd(
+                    engine,
+                    CommunityData(community, mpModel=_mp_model(version)),
+                    UdpTransportTarget((host, port), timeout=5, retries=1),
+                    ContextData(),
+                    ObjectType(ObjectIdentity(oid)),
+                )
+            )
+        except Exception as exc:
+            logger.debug("SNMP GET %s@%s OID %s failed: %s", host, port, oid, exc)
+            continue
+
+        if error_indication:
+            logger.debug("SNMP error %s@%s OID %s: %s", host, port, oid, error_indication)
+            continue
+        if error_status:
+            logger.debug("SNMP status %s@%s OID %s: %s at %s",
+                         host, port, oid, error_status.prettyPrint(),
+                         error_index and var_binds[int(error_index) - 1][0] or "?")
+            continue
+
+        for _, val in var_binds:
+            try:
+                results[label] = float(val) * scale
+            except (TypeError, ValueError):
+                # Non-numeric type (e.g. OctetString description) — skip
+                logger.debug("SNMP non-numeric value for %s label=%s: %r", oid, label, val)
+
+    return results