feat: redesign user host defaults system

src/backend/tests/plugins/security/credential-shapes.test.ts

@@ -77,7 +77,14 @@ vi.mock("../../../utils/permission-manager.js", () => ({
     }),
   },
 }));
+vi.mock("../../../hosts/defaults/index.js", () => ({
+  applyHostDefaultsToWrite: async () => ({ core: [] }),
+  applyDefaultsAfterHostWrite: async () => {},
+}));
 vi.mock("../../../database/repositories/factory.js", () => ({
+  createCurrentHostDefaultsRepository: () => ({
+    listHosts: async () => [],
+  }),
   createCurrentHostRepository: () => ({
     createEncryptedForUser: async () => secretHost(1),
     updateEncryptedForUser: async () => secretHost(1),

src/backend/tests/plugins/security/ctx-guards.test.ts

@@ -58,6 +58,10 @@ const UNGATED: Record<string, string> = {
   "settings.getUser": "the plugin's own user settings",
   "settings.setUser": "the plugin's own user settings",
   "settings.getHost": "the plugin's own host settings",
+  "settings.getHostFor":
+    "the plugin's own host settings, as one user sees them",
+  "settings.getHostDefault":
+    "the plugin's own host settings, as a user's defaults",
   "settings.setHost": "the plugin's own host settings",
   "settings.getAll": "the plugin's own settings",
   "settings.onChange": "the plugin's own settings",