feat(ui): plugin get_nav() hook → sidebar Infrastructure links (slice 2)

Plugin UIs had no nav home (only dashboard widgets / typed URLs). Add an
optional get_nav() plugin export and surface it in the sidebar.

- plugin_manager: _PLUGIN_NAV registry + get_plugin_nav() getter + a tolerant
  _collect_plugin_nav() (missing hook = fine; raising/malformed = logged &
  skipped; idempotent per plugin so hot-reload re-runs cleanly). Collected in
  both the startup load path and the hot-reload path.
- app.py: inject plugin_nav into the template context, filtered to enabled
  plugins so a hot-disabled plugin's link can't linger before restart.
- base.html: render plugin links under the Infrastructure group, with the same
  request.path active-state treatment as core links.
- docker/snmp/unifi/traefik: each exports get_nav() → its /plugins/<name>/ view.
- Tests: collector behavior (collect, missing hook, reload-replace, malformed
  item, raising hook, sorted output).

With docker enabled, "Docker" now appears under Infrastructure → its fleet view.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC

steward/app.py

@@ -177,7 +177,7 @@ def create_app(
     # ── 10. Template context: inject plugin_failures into every response ───────
     @app.context_processor
     def _inject_plugin_failures():
-        from .core.plugin_manager import get_plugin_failures
+        from .core.plugin_manager import get_plugin_failures, get_plugin_nav
         from .core.settings import get_undecryptable_secrets
         # enabled_plugins lets templates gate cross-plugin embeds (e.g. the
         # Hosts hub only fetches the docker fragment when docker is enabled),
@@ -186,9 +186,13 @@ def create_app(
             name for name, cfg in (app.config.get("PLUGINS") or {}).items()
             if isinstance(cfg, dict) and cfg.get("enabled")
         }
+        # Sidebar entries for enabled plugins that expose a UI (get_nav). Filter
+        # by enabled so a hot-disabled plugin's link can't linger before restart.
+        plugin_nav = [e for e in get_plugin_nav() if e["plugin"] in enabled_plugins]
         return {
             "plugin_failures": get_plugin_failures(),
             "enabled_plugins": enabled_plugins,
+            "plugin_nav": plugin_nav,
             # Read from an in-memory cache (no DB hit per render); kept current by
             # the startup scan + set_setting's discard-on-write.
             "undecryptable_secrets": get_undecryptable_secrets(),