feat(plugin): 插件热安装(MCP server) — POST /admin/plugins/install 连接+发现+注册工具进registry+落盘plugins.json

- capability/plugin/manager.go: Manager(Install/Uninstall/List/Restore/Close); Install=连接+发现+mcp:name注册工具,失败不落盘; holder持有*mcp.Registry; boot Restore重装
- config/runtimeconfig/plugins.go: PluginConfig(Normalize/Validate), LoadPlugins/SavePlugins(0600+tmp+rename)/Upsert/Delete/Masked(apiKey+敏感env掩码)
- mcp: MCPConfig加APIKey/Env, http/sse Bearer应用, stdio子进程env合并; registry.ToolNames()
- gateway: adminPluginInstall/Uninstall/ListInstalledPlugins; Deps.Plugins注入
- cmd/cyrene/plugins.go: wirePlugins(boot Restore+close)
- 契约: body{kind:mcp,name,config{transport, endpoint?/command?,args?,apiKey?,env?}} → {installed,name,kind,transport,toolCount}; 失败502不落盘/非法400/未注入501; 卸载连带unregister+删配置
- 测试(manager/plugins/admin/mcp_auth/组合根), build/vet/test绿+3平台交叉编译
- Docs/api-client v0.28 + api-reference install=501改真实; .gitignore加plugins.json
- 前端api.ts仍发旧body(无config)会400, 面板安装表单待后续

internal/services/gateway/server.go

@@ -30,6 +30,7 @@ import (
 
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/bus"
+	pluginmgr "git.yeij.top/AskaEth/Cyrene_v2/internal/capability/plugin"
 	capreg "git.yeij.top/AskaEth/Cyrene_v2/internal/capability/registry"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/session"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
@@ -293,6 +294,11 @@ type Deps struct {
 	// Optional: when nil the admin /channels/config endpoints return a clear
 	// not-configured error, matching how the LLM stack behaves when unset.
 	Channels ChannelConfigStore
+	// Plugins is the runtime-installable external tool provider manager
+	// (plugins.json + live MCP servers). Optional: when nil install answers a
+	// clear not-implemented error and uninstall falls back to a plain capability
+	// removal, so pre-existing gateway tests keep working.
+	Plugins *pluginmgr.Manager
 	// OwnerRegistrar stamps a scan-login's bound owner id into the owner
 	// whitelist (configs/users/owner.yaml) and hot-updates the live profile.
 	// Optional: when nil the weixin confirm flow still persists channels.json but
@@ -364,6 +370,9 @@ type Server struct {
 	// that do not wire it keep working.
 	llm      *model.RuntimeLLM
 	channels ChannelConfigStore
+	// plugins is the runtime-installable external tool provider manager. See
+	// Deps.Plugins.
+	plugins *pluginmgr.Manager
 	// ownerRegistrar stamps a scan-login bound owner id into the owner whitelist
 	// (best-effort). See Deps.OwnerRegistrar.
 	ownerRegistrar OwnerRegistrar
@@ -405,6 +414,7 @@ func New(cfg *config.Config, deps Deps) (*Server, error) {
 		frontend:       deps.Frontend,
 		llm:            deps.LLM,
 		channels:       deps.Channels,
+		plugins:        deps.Plugins,
 		ownerRegistrar: deps.OwnerRegistrar,
 		webhooks:       deps.Webhooks,
 		dbPath:         deps.DatabasePath,
@@ -472,6 +482,7 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("GET /api/v1/admin/sessions", adminAuth(http.HandlerFunc(s.adminListSessions)))
 	mux.Handle("GET /api/v1/admin/memories", adminAuth(http.HandlerFunc(s.adminListMemories)))
 	mux.Handle("GET /api/v1/admin/plugins", adminAuth(http.HandlerFunc(s.adminListPlugins)))
+	mux.Handle("GET /api/v1/admin/plugins/installed", adminAuth(http.HandlerFunc(s.adminListInstalledPlugins)))
 	mux.Handle("GET /api/v1/admin/channels", adminAuth(http.HandlerFunc(s.adminListChannels)))
 	mux.Handle("GET /api/v1/admin/channels/messages", adminAuth(http.HandlerFunc(s.handleChannelMessages)))
 	mux.Handle("GET /api/v1/admin/channels/{platform}/messages", adminAuth(http.HandlerFunc(s.handleChannelPlatformLog)))