feat: harden plugin api for separate repos, signed updates and generic external login

src/backend/tests/plugins/security/actor.test.ts

@@ -81,7 +81,13 @@ function contextFor(pluginId: string, extra: Record<string, unknown> = {}) {
       license: "MIT",
       category: "Productivity",
       engine: { termix: ">=2.9.0", api: "1" },
-      capabilities: ["hosts:read", "ssh:connect", "credentials:use"],
+      capabilities: [
+        "hosts:read",
+        "ssh:connect",
+        "credentials:use",
+        "users:impersonate",
+      ],
+      requires: [{ service: "sample.echo", versionRange: "^1.0.0" }],
       ...extra,
     } as never,
     handle,