feat: harden plugin api for separate repos, signed updates and generic external login

src/backend/tests/plugins/ctx-db.test.ts

@@ -190,10 +190,17 @@ describe("ctx.db capability", () => {
     });
   });
 
-  it("hands back read-only refs to the core tables a plugin may join", async () => {
+  it("refuses core refs with only db:own", async () => {
     grants.set("demo", ["db:own"]);
     const { ctx } = contextFor("demo", ["db:own"]);
 
+    await expect(ctx.db.refs()).rejects.toThrow(/db:core-refs/);
+  });
+
+  it("hands back refs to the core tables a plugin may join", async () => {
+    grants.set("demo", ["db:core-refs"]);
+    const { ctx } = contextFor("demo", ["db:core-refs"]);
+
     const refs = (await ctx.db.refs()) as Record<string, unknown>;
 
     expect(Object.keys(refs).sort()).toEqual([