fix(settings): the plugin catalog is fetched by a scheduled task, never by a page load

The operator's ruling (Background Jobs, 2026-10-08): a Steward page reads
stored records; the sources are contacted by scheduled collection. An audit
of every GET handler, HTMX fragment, widget poll and MCP read tool found one
page load that reached out: Settings -> Plugins' catalog fragment fetched
each plugin repository (5 min cache, 10 s timeout each, retried on every
load when unreachable).

plugin_catalog_refresh ticks every minute and fetches a repository whose
copy is missing or older than an hour, waiting 5 min after a failure;
saving repositories clears the cache, so the next tick fetches. The
fragment only reads the cache and says which repositories are not fetched
yet. Refresh is now a POST that fetches at once, as does install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/plugins.html

@@ -160,7 +160,7 @@
   <div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:0.75rem;">
     <div class="section-title">Plugin Catalog</div>
     <button class="btn btn-ghost btn-sm" style="font-size:0.78rem;"
-            hx-get="/settings/plugins/catalog/?refresh=1"
+            hx-post="/settings/plugins/catalog/refresh"
             hx-target="#plugin-catalog"
             hx-swap="outerHTML">
       Refresh