feat(plugins): fold first-party plugins in-tree; bundled + external roots

First-party plugins (host_agent, http, snmp, traefik, unifi, docker) are now
tracked under plugins/ and baked into the image, so they version atomically
with core — ending the cross-repo import drift the roundtable->steward rename
exposed. History for these files is preserved in the archived Roundtable-plugins
repo.

Plugin discovery becomes multi-root: PLUGIN_DIR (single) -> PLUGIN_DIRS
(bundled first, then external) + PLUGIN_INSTALL_DIR. Bundled ships in the image;
third-party plugins still mount at runtime into the external root
(STEWARD_PLUGIN_DIR, default /data/plugins) and downloads/installs land there.
Bundled shadows external on a name collision.

- config.py: load_bootstrap returns plugin_dirs + plugin_install_dir
- app.py: iterate PLUGIN_DIRS at the migration + load sites
- migration_runner.py: discover_all_in() unions every plugin root
- plugin_manager.py: resolve_plugin_path() (pure, first-root-wins); load /
  install / hot-reload span all roots; installs target the external root
- settings/routes.py: _discover_plugins scans all roots, dedup bundled-first
- Dockerfile: COPY plugins/ ; docker-compose: drop host bind, document external
- tests/test_plugin_dirs.py: resolution, multi-root discovery, bootstrap split

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/config.py

@@ -15,7 +15,7 @@ def _env(suffix: str) -> str | None:
     return os.environ.get(f"STEWARD_{suffix}")
 
 
-def load_bootstrap(config_path: Path | str | None = None) -> dict[str, str]:
+def load_bootstrap(config_path: Path | str | None = None) -> dict[str, Any]:
     """Return the minimum bootstrap config: database_url and secret_key.
 
     This is the only config read from files/env vars at startup.
@@ -48,15 +48,29 @@ def load_bootstrap(config_path: Path | str | None = None) -> dict[str, str]:
         )
 
     secret_key = _resolve_secret_key(raw)
-    plugin_dir = (
+
+    # Plugin discovery spans two roots (see load_plugins / migration_runner):
+    #   • bundled  — first-party plugins shipped inside the image at repo-root
+    #     `plugins/`; they version atomically with core and are read-only at runtime.
+    #   • external — operator-mounted dir for third-party plugins, persisted in the
+    #     /data volume. Downloads/installs land here, never in the bundled dir.
+    # Bundled is scanned first, so on a name collision the first-party plugin wins.
+    bundled_plugin_dir = raw.get("plugin_dir", "plugins")
+    external_plugin_dir = (
         _env("PLUGIN_DIR")
-        or raw.get("plugin_dir", "plugins")
+        or raw.get("external_plugin_dir")
+        or "/data/plugins"
     )
+    plugin_dirs = [bundled_plugin_dir]
+    if external_plugin_dir and external_plugin_dir != bundled_plugin_dir:
+        plugin_dirs.append(external_plugin_dir)
 
     return {
         "database_url": database_url,
         "secret_key": secret_key,
-        "plugin_dir": plugin_dir,
+        "plugin_dirs": plugin_dirs,
+        # Installs/downloads target the external (writable, persistent) dir.
+        "plugin_install_dir": external_plugin_dir or bundled_plugin_dir,
     }