feat(plugins): fold first-party plugins in-tree; bundled + external roots

First-party plugins (host_agent, http, snmp, traefik, unifi, docker) are now
tracked under plugins/ and baked into the image, so they version atomically
with core — ending the cross-repo import drift the roundtable->steward rename
exposed. History for these files is preserved in the archived Roundtable-plugins
repo.

Plugin discovery becomes multi-root: PLUGIN_DIR (single) -> PLUGIN_DIRS
(bundled first, then external) + PLUGIN_INSTALL_DIR. Bundled ships in the image;
third-party plugins still mount at runtime into the external root
(STEWARD_PLUGIN_DIR, default /data/plugins) and downloads/installs land there.
Bundled shadows external on a name collision.

- config.py: load_bootstrap returns plugin_dirs + plugin_install_dir
- app.py: iterate PLUGIN_DIRS at the migration + load sites
- migration_runner.py: discover_all_in() unions every plugin root
- plugin_manager.py: resolve_plugin_path() (pure, first-root-wins); load /
  install / hot-reload span all roots; installs target the external root
- settings/routes.py: _discover_plugins scans all roots, dedup bundled-first
- Dockerfile: COPY plugins/ ; docker-compose: drop host bind, document external
- tests/test_plugin_dirs.py: resolution, multi-root discovery, bootstrap split

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/settings/routes.py

@@ -19,22 +19,32 @@ logger = logging.getLogger(__name__)
 
 
 def _discover_plugins() -> list[dict]:
-    """Scan PLUGIN_DIR for plugin.yaml files."""
+    """Scan every plugin root for plugin.yaml files.
+
+    Roots are scanned in order (bundled first), and a plugin name found in an
+    earlier root shadows the same name in a later one — matching load_plugins.
+    """
     import yaml
-    plugin_dir = Path(current_app.config.get("PLUGIN_DIR", "plugins")).resolve()
-    plugins = []
-    if not plugin_dir.exists():
-        return plugins
-    for entry in sorted(plugin_dir.iterdir()):
-        yaml_path = entry / "plugin.yaml"
-        if entry.is_dir() and yaml_path.exists():
-            try:
-                with yaml_path.open() as f:
-                    meta = yaml.safe_load(f) or {}
-                meta["_dir"] = entry.name
-                plugins.append(meta)
-            except Exception:
-                logger.warning("Could not read %s", yaml_path)
+    plugin_dirs = [
+        Path(d).resolve()
+        for d in current_app.config.get("PLUGIN_DIRS", ["plugins"])
+    ]
+    plugins: list[dict] = []
+    seen: set[str] = set()
+    for plugin_dir in plugin_dirs:
+        if not plugin_dir.exists():
+            continue
+        for entry in sorted(plugin_dir.iterdir()):
+            yaml_path = entry / "plugin.yaml"
+            if entry.is_dir() and yaml_path.exists() and entry.name not in seen:
+                try:
+                    with yaml_path.open() as f:
+                        meta = yaml.safe_load(f) or {}
+                    meta["_dir"] = entry.name
+                    plugins.append(meta)
+                    seen.add(entry.name)
+                except Exception:
+                    logger.warning("Could not read %s", yaml_path)
     return plugins