feat: ship the AI assistant as a first-party in-process plugin

Moves src/backend/ai and its routes into plugins/ai, mounted through a
small /ai dispatcher instead of its own port. Moves the ai-enabled and
ai-private-endpoints settings routes out of user-settings-routes.ts
into the plugin too, so it has no leftover core dependents.

plugins/ai/backend/tools/catalog.ts

@@ -0,0 +1,68 @@
+import { proposeTools } from "./propose-tools.js";
+import { readTools } from "./read-tools.js";
+import type { AiTool, ToolDefinitionShape } from "./types.js";
+
+/**
+ * The allowlist, and the security boundary for the whole feature.
+ *
+ * A model can only ever invoke what appears here. Route-level RBAC gates the
+ * HTTP API, but tools run in-process with the calling user's identity and never
+ * pass through a router, so "the assistant cannot reach credentials or user
+ * administration" is a property of this list, not of the permission system.
+ *
+ * Anything touching credentials, vaults, RBAC, users, identity, certificates,
+ * SSO or instance settings is deliberately absent and must stay absent.
+ */
+export const AI_TOOLS: AiTool[] = [...readTools, ...proposeTools];
+
+const BY_NAME = new Map(AI_TOOLS.map((tool) => [tool.name, tool]));
+
+export function getTool(name: string): AiTool | undefined {
+  return BY_NAME.get(name);
+}
+
+export function listToolNames(): string[] {
+  return AI_TOOLS.map((tool) => tool.name);
+}
+
+/**
+ * Domains the assistant must never be able to reach, in any tool, ever.
+ * The catalog test asserts no tool name references these.
+ */
+export const FORBIDDEN_DOMAINS = [
+  "credential",
+  "vault",
+  "rbac",
+  "role",
+  "permission",
+  "user_admin",
+  "password",
+  "totp",
+  "webauthn",
+  "passkey",
+  "api_key",
+  "session",
+  "oidc",
+  "sso",
+  "ldap",
+  "termix_id",
+  "identity",
+  "certificate",
+  "opkssh",
+  "stepca",
+  "step_ca",
+  "acme",
+  "ssl",
+  "audit",
+  "sync",
+  "settings",
+];
+
+/** Tool definitions in the shape the provider adapters expect. */
+export function toolDefinitions(): ToolDefinitionShape[] {
+  return AI_TOOLS.map((tool) => ({
+    name: tool.name,
+    description: tool.description,
+    parameters: tool.parameters,
+  }));
+}