feat(plugin): 插件热安装(MCP server) — POST /admin/plugins/install 连接+发现+注册工具进registry+落盘plugins.json

- capability/plugin/manager.go: Manager(Install/Uninstall/List/Restore/Close); Install=连接+发现+mcp:name注册工具,失败不落盘; holder持有*mcp.Registry; boot Restore重装
- config/runtimeconfig/plugins.go: PluginConfig(Normalize/Validate), LoadPlugins/SavePlugins(0600+tmp+rename)/Upsert/Delete/Masked(apiKey+敏感env掩码)
- mcp: MCPConfig加APIKey/Env, http/sse Bearer应用, stdio子进程env合并; registry.ToolNames()
- gateway: adminPluginInstall/Uninstall/ListInstalledPlugins; Deps.Plugins注入
- cmd/cyrene/plugins.go: wirePlugins(boot Restore+close)
- 契约: body{kind:mcp,name,config{transport, endpoint?/command?,args?,apiKey?,env?}} → {installed,name,kind,transport,toolCount}; 失败502不落盘/非法400/未注入501; 卸载连带unregister+删配置
- 测试(manager/plugins/admin/mcp_auth/组合根), build/vet/test绿+3平台交叉编译
- Docs/api-client v0.28 + api-reference install=501改真实; .gitignore加plugins.json
- 前端api.ts仍发旧body(无config)会400, 面板安装表单待后续

cmd/cyrene/wire.go

@@ -14,6 +14,7 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/bus"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/capability/mcp"
+	pluginmgr "git.yeij.top/AskaEth/Cyrene_v2/internal/capability/plugin"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/capability/registry"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/adapter"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/session"
@@ -93,6 +94,7 @@ type app struct {
 	iot           *iot.Manager
 	voice         *voice.Chain
 	mcpRegs       []*mcp.Registry
+	plugins       *pluginmgr.Manager
 	sessions      *session.SessionManager
 	automation    *automations.Service
 	backthink     *backthink.Backthink
@@ -214,6 +216,7 @@ func newApp(ctx context.Context, cfg *config.Config, log *slog.Logger) (*app, er
 	if err := a.wireAuxiliary(); err != nil {
 		return a, err
 	}
+	a.wirePlugins(ctx)
 	if err := a.wireChannels(); err != nil {
 		return a, err
 	}
@@ -690,6 +693,7 @@ func (a *app) wireFrontend() error {
 		RAG:            ragStore,
 		LLM:            a.llm,
 		Channels:       a.channels,
+		Plugins:        a.plugins,
 		OwnerRegistrar: &ownerRegistrar{path: defaultOwnerPath, owner: a.owner, log: a.log},
 		AuditStore:     auditStore,
 		Streaming:      true,
@@ -784,6 +788,9 @@ func (a *app) close(ctx context.Context) {
 	for _, reg := range a.mcpRegs {
 		_ = reg.Unregister(ctx)
 	}
+	if a.plugins != nil {
+		a.plugins.Close(ctx)
+	}
 	if a.tasks != nil {
 		_ = a.tasks.Close()
 	}