fix: harden plugin auth and add per-request identity for ctx calls

Require auth on /plugin-api, gate plugin enable/grant/revoke routes
behind admin.plugins.manage, and thread the calling user through
worker ctx.hosts/ctx.ssh calls instead of always using the install
owner. Also adds the plugin permissions grant/revoke UI.

src/backend/database/database.ts

@@ -1781,7 +1781,7 @@ app.use("/ai", aiRoutes);
 app.use("/", alertRulesRoutes);
 app.use("/sync", syncRoutes);
 app.use("/plugins", pluginRoutes);
-app.use("/plugin-api", pluginApiRoutes);
+app.use("/plugin-api", authenticateJWT, pluginApiRoutes);
 
 const frontendDistPaths = [
   path.join(__dirname, "../../../dist"),