feat(plugin): 插件热安装(MCP server) — POST /admin/plugins/install 连接+发现+注册工具进registry+落盘plugins.json

- capability/plugin/manager.go: Manager(Install/Uninstall/List/Restore/Close); Install=连接+发现+mcp:name注册工具,失败不落盘; holder持有*mcp.Registry; boot Restore重装
- config/runtimeconfig/plugins.go: PluginConfig(Normalize/Validate), LoadPlugins/SavePlugins(0600+tmp+rename)/Upsert/Delete/Masked(apiKey+敏感env掩码)
- mcp: MCPConfig加APIKey/Env, http/sse Bearer应用, stdio子进程env合并; registry.ToolNames()
- gateway: adminPluginInstall/Uninstall/ListInstalledPlugins; Deps.Plugins注入
- cmd/cyrene/plugins.go: wirePlugins(boot Restore+close)
- 契约: body{kind:mcp,name,config{transport, endpoint?/command?,args?,apiKey?,env?}} → {installed,name,kind,transport,toolCount}; 失败502不落盘/非法400/未注入501; 卸载连带unregister+删配置
- 测试(manager/plugins/admin/mcp_auth/组合根), build/vet/test绿+3平台交叉编译
- Docs/api-client v0.28 + api-reference install=501改真实; .gitignore加plugins.json
- 前端api.ts仍发旧body(无config)会400, 面板安装表单待后续

internal/capability/mcp/http.go

@@ -145,6 +145,7 @@ func (s *streamableHTTPTransport) post(ctx context.Context, body []byte) (*http.
 func (s *streamableHTTPTransport) applyHeaders(req *http.Request) {
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Accept", "application/json, text/event-stream")
+	s.applyAuth(req)
 	s.mu.Lock()
 	session := s.session
 	proto := ""
@@ -160,6 +161,14 @@ func (s *streamableHTTPTransport) applyHeaders(req *http.Request) {
 	}
 }
 
+// applyAuth sets the bearer credential an authenticated server requires. It is
+// a no-op when the config carries no API key.
+func (s *streamableHTTPTransport) applyAuth(req *http.Request) {
+	if s.cfg.APIKey != "" {
+		req.Header.Set("Authorization", "Bearer "+s.cfg.APIKey)
+	}
+}
+
 // captureSession stores a session id returned by the server.
 func (s *streamableHTTPTransport) captureSession(resp *http.Response) {
 	if sid := resp.Header.Get(mcpSessionIDHeader); sid != "" {
@@ -321,6 +330,7 @@ func (s *streamableHTTPTransport) readStandalone(ctx context.Context) {
 			return
 		}
 		req.Header.Set("Accept", "text/event-stream")
+		s.applyAuth(req)
 		s.mu.Lock()
 		session := s.session
 		proto := ""