feat(plugin): 插件热安装(MCP server) — POST /admin/plugins/install 连接+发现+注册工具进registry+落盘plugins.json

- capability/plugin/manager.go: Manager(Install/Uninstall/List/Restore/Close); Install=连接+发现+mcp:name注册工具,失败不落盘; holder持有*mcp.Registry; boot Restore重装
- config/runtimeconfig/plugins.go: PluginConfig(Normalize/Validate), LoadPlugins/SavePlugins(0600+tmp+rename)/Upsert/Delete/Masked(apiKey+敏感env掩码)
- mcp: MCPConfig加APIKey/Env, http/sse Bearer应用, stdio子进程env合并; registry.ToolNames()
- gateway: adminPluginInstall/Uninstall/ListInstalledPlugins; Deps.Plugins注入
- cmd/cyrene/plugins.go: wirePlugins(boot Restore+close)
- 契约: body{kind:mcp,name,config{transport, endpoint?/command?,args?,apiKey?,env?}} → {installed,name,kind,transport,toolCount}; 失败502不落盘/非法400/未注入501; 卸载连带unregister+删配置
- 测试(manager/plugins/admin/mcp_auth/组合根), build/vet/test绿+3平台交叉编译
- Docs/api-client v0.28 + api-reference install=501改真实; .gitignore加plugins.json
- 前端api.ts仍发旧body(无config)会400, 面板安装表单待后续

internal/capability/mcp/mcp.go

@@ -149,6 +149,12 @@ type MCPConfig struct {
 	// TransportType selects the transport explicitly: "stdio", "sse" or
 	// "http" (Streamable HTTP). Empty means infer from Command/URL.
 	TransportType string `env:"MCP_TRANSPORT"`
+	// APIKey is the bearer credential sent to an http/sse server as an
+	// Authorization header. Empty means the server needs no auth.
+	APIKey string `env:"MCP_API_KEY"`
+	// Env is extra environment for a stdio subprocess, merged over the parent
+	// process environment (extra keys win). It is ignored by the HTTP transports.
+	Env map[string]string `env:"MCP_ENV"`
 	// Enabled reports whether this server should be activated at startup.
 	Enabled bool `env:"MCP_ENABLED"`
 }