fix: harden plugin auth and add per-request identity for ctx calls

Require auth on /plugin-api, gate plugin enable/grant/revoke routes
behind admin.plugins.manage, and thread the calling user through
worker ctx.hosts/ctx.ssh calls instead of always using the install
owner. Also adds the plugin permissions grant/revoke UI.

src/ui/api/plugins-api.ts

@@ -21,6 +21,10 @@ export interface PluginSummary {
   runtimeState: string;
   lastError: string | null;
   contributes: PluginContributions | null;
+  /** Capabilities this plugin's manifest declares it may ask for. */
+  permissions: string[];
+  /** The subset of `permissions` an admin has actually granted. */
+  grantedCapabilities: string[];
 }
 
 export async function getPlugins(): Promise<PluginSummary[]> {
@@ -36,3 +40,21 @@ export async function setPluginEnabled(
     enabled,
   });
 }
+
+export async function grantPluginCapability(
+  pluginId: string,
+  capability: string,
+): Promise<void> {
+  await rbacApi.post(`/plugins/${encodeURIComponent(pluginId)}/grants`, {
+    capability,
+  });
+}
+
+export async function revokePluginCapability(
+  pluginId: string,
+  capability: string,
+): Promise<void> {
+  await rbacApi.delete(
+    `/plugins/${encodeURIComponent(pluginId)}/grants/${encodeURIComponent(capability)}`,
+  );
+}