feat(plugins): fold first-party plugins in-tree; bundled + external roots

First-party plugins (host_agent, http, snmp, traefik, unifi, docker) are now
tracked under plugins/ and baked into the image, so they version atomically
with core — ending the cross-repo import drift the roundtable->steward rename
exposed. History for these files is preserved in the archived Roundtable-plugins
repo.

Plugin discovery becomes multi-root: PLUGIN_DIR (single) -> PLUGIN_DIRS
(bundled first, then external) + PLUGIN_INSTALL_DIR. Bundled ships in the image;
third-party plugins still mount at runtime into the external root
(STEWARD_PLUGIN_DIR, default /data/plugins) and downloads/installs land there.
Bundled shadows external on a name collision.

- config.py: load_bootstrap returns plugin_dirs + plugin_install_dir
- app.py: iterate PLUGIN_DIRS at the migration + load sites
- migration_runner.py: discover_all_in() unions every plugin root
- plugin_manager.py: resolve_plugin_path() (pure, first-root-wins); load /
  install / hot-reload span all roots; installs target the external root
- settings/routes.py: _discover_plugins scans all roots, dedup bundled-first
- Dockerfile: COPY plugins/ ; docker-compose: drop host bind, document external
- tests/test_plugin_dirs.py: resolution, multi-root discovery, bootstrap split

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/core/migration_runner.py

@@ -24,14 +24,26 @@ def discover_all_plugin_migration_dirs(plugin_dir: Path) -> list[Path]:
     return dirs
 
 
-def run_core_migrations(db_url: str, plugin_dir: Path | None = None) -> None:
+def discover_all_in(plugin_dirs: list[Path]) -> list[Path]:
+    """discover_all_plugin_migration_dirs across multiple plugin roots.
+
+    Plugins now live in more than one root (bundled + external), so the full
+    revision graph is the union of every root's migration dirs.
+    """
+    dirs: list[Path] = []
+    for pd in plugin_dirs:
+        dirs.extend(discover_all_plugin_migration_dirs(pd))
+    return dirs
+
+
+def run_core_migrations(db_url: str, plugin_dirs: list[Path] | None = None) -> None:
     """Run core Alembic migrations.
 
-    Includes all discovered plugin migration dirs (if plugin_dir given) so
+    Includes all discovered plugin migration dirs (across every plugin root) so
     Alembic can resolve any previously-applied plugin revisions in the graph.
     Called first so the app_settings table exists before loading settings.
     """
-    dirs = discover_all_plugin_migration_dirs(plugin_dir) if plugin_dir else []
+    dirs = discover_all_in(plugin_dirs) if plugin_dirs else []
     _run(db_url, plugin_migration_dirs=dirs)