fix: harden plugin auth and add per-request identity for ctx calls

Require auth on /plugin-api, gate plugin enable/grant/revoke routes
behind admin.plugins.manage, and thread the calling user through
worker ctx.hosts/ctx.ssh calls instead of always using the install
owner. Also adds the plugin permissions grant/revoke UI.

src/ui/locales/en.json

@@ -3984,7 +3984,37 @@
     "pluginToggleFailed": "Failed to change the plugin",
     "pluginBuiltIn": "BUILT IN",
     "pluginEnabled": "{{name}} enabled",
-    "pluginDisabled": "{{name}} disabled"
+    "pluginDisabled": "{{name}} disabled",
+    "pluginPermissions": "Permissions",
+    "pluginPermissionsNone": "This plugin does not declare any capabilities that need to be granted.",
+    "pluginPermissionGranted": "Granted",
+    "pluginPermissionNotGranted": "Not granted",
+    "pluginGrantFailed": "Failed to grant the capability",
+    "pluginRevokeFailed": "Failed to revoke the capability",
+    "pluginPermissionHostsRead": "Read hosts",
+    "pluginPermissionHostsReadDesc": "See the list of your hosts and their non-secret details.",
+    "pluginPermissionHostsWrite": "Modify hosts",
+    "pluginPermissionHostsWriteDesc": "Create, edit or delete hosts on your behalf.",
+    "pluginPermissionCredentialsUse": "Use stored credentials",
+    "pluginPermissionCredentialsUseDesc": "Connect using a saved credential without you retyping it.",
+    "pluginPermissionSshExec": "Run commands over SSH",
+    "pluginPermissionSshExecDesc": "Open a connection to a host and run commands on it.",
+    "pluginPermissionSshSftp": "Transfer files over SFTP",
+    "pluginPermissionSshSftpDesc": "Read or write files on a host over SFTP.",
+    "pluginPermissionStorageOwn": "Store its own data",
+    "pluginPermissionStorageOwnDesc": "Save and read back its own settings and data.",
+    "pluginPermissionStorageSecrets": "Store secrets",
+    "pluginPermissionStorageSecretsDesc": "Save and read back sensitive values it manages itself.",
+    "pluginPermissionNetworkOutbound": "Make outbound network requests",
+    "pluginPermissionNetworkOutboundDesc": "Contact services outside this server.",
+    "pluginPermissionEventsRead": "Subscribe to server events",
+    "pluginPermissionEventsReadDesc": "React to things happening elsewhere in Termix.",
+    "pluginPermissionNotifySend": "Send notifications",
+    "pluginPermissionNotifySendDesc": "Deliver a notification through your configured channels.",
+    "pluginPermissionUsersRead": "Read user accounts",
+    "pluginPermissionUsersReadDesc": "See basic details about accounts on this server.",
+    "pluginPermissionProcessSidecar": "Run a background process",
+    "pluginPermissionProcessSidecarDesc": "Start and manage its own helper process."
   },
   "newUi": {
     "sidebar": {