Initial commit: SenSu Alpha 0.2.0

- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests

Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)

static/web_panel/pages/plugins.js

@@ -0,0 +1,36 @@
+window.PluginsModule = {
+    init: () => window.PluginsModule.refresh(),
+    refresh: async () => {
+        const list = document.getElementById('plugin-list');
+        if(!list) return;
+        list.innerHTML = '加载中...';
+        try {
+            const res = await fetch('./api/plugins', {credentials:'include'});
+            const data = await res.json();
+            if(!data.plugins?.length) { list.innerHTML = '<div style="color:var(--text-dim)">暂无已加载插件</div>'; return; }
+            
+            list.innerHTML = data.plugins.map(p => `
+                <div class="plugin-card">
+                    <div class="plugin-info">
+                        <h4>${p.name} <span class="badge ${p.running?'badge-run':'badge-stop'}">${p.running?'RUNNING':'STOPPED'}</span></h4>
+                        <p>v${p.version||'1.0.0'} | ${p.enabled?'已启用':'已禁用'}</p>
+                    </div>
+                    <div class="plugin-act">
+                        ${p.running 
+                            ? `<button class="btn-sm" onclick="window.PluginsModule.act('${p.name}','disable')">停用</button>`
+                            : `<button class="btn-sm" onclick="window.PluginsModule.act('${p.name}','enable')">启用</button>`
+                        }
+                        <button class="btn-sm" onclick="window.PluginsModule.act('${p.name}','reload')">重载</button>
+                    </div>
+                </div>
+            `).join('');
+        } catch(e) { list.innerHTML = '加载失败'; }
+    },
+    act: async (name, action) => {
+        try {
+            await fetch(`./api/plugins/${name}/${action}`, {method:'POST', credentials:'include'});
+            setTimeout(window.PluginsModule.refresh, 500);
+        } catch(e) { alert('操作失败'); }
+    },
+    destroy: () => {}
+};