plugin disable system: kernel→SDK PluginManager + WebUI/CLI

- New disabled_plugins table (name, disabled_at, disabled_by)
- SDK.PluginManager interface: DisablePlugin/EnablePlugin/ListDisabledPlugins
- Registry implements PluginManager, wired into PluginSDK
- WebUI: POST /api/v1/plugins/<name>/disable|enable + plugins page with toggle
- Disabling webui shows confirmation dialog
- CLI: /plugin disable <name> / /plugin enable <name>
- pluginmgr removePlugin sync-cleanup from disabled_plugins table

internal/sdk/plugin.go

@@ -51,13 +51,31 @@ type OutputChannelRegistrar = pubsdk.OutputChannelRegistrar
 type InputChannelRegistrar = pubsdk.InputChannelRegistrar
 type ChannelDef = pubsdk.ChannelDef
 
+type DisabledPluginInfo struct {
+	Name       string `json:"name"`
+	DisabledAt string `json:"disabled_at"`
+	DisabledBy string `json:"disabled_by"`
+}
+
+type PluginManager interface {
+	ListLoadedPlugins() []string
+	ListDisabledPlugins() []DisabledPluginInfo
+	IsPluginDisabled(name string) bool
+	DisablePlugin(name, by string) error
+	EnablePlugin(name string) error
+	ReloadPlugins() (string, error)
+}
+
 type PluginSDK struct {
 	*pubsdk.PluginSDK
-	iom      *agentIO.IOManager
-	eventBus *events.Bus
-	logger   *log.Logger
+	iom       *agentIO.IOManager
+	eventBus  *events.Bus
+	logger    *log.Logger
+	pluginMgr PluginManager
 }
 
+func (s *PluginSDK) PluginMgr() PluginManager { return s.pluginMgr }
+
 // ioAdapter 桥接 IOManager 到公共 SDK 的 IOInjector 接口，
 // 确保外部插件通过 s.InjectText() 等方法的调用能被路由到内核 IO 层。
 type ioAdapter struct{ iom *agentIO.IOManager }
@@ -95,6 +113,7 @@ type SDKConfig struct {
 	RegAPI     APIRegistrar
 	RegOutput  OutputChannelRegistrar
 	RegInput   InputChannelRegistrar
+	PluginMgr  PluginManager
 }
 
 func New(name string, cfg SDKConfig) *PluginSDK {
@@ -115,6 +134,7 @@ func New(name string, cfg SDKConfig) *PluginSDK {
 		iom:       cfg.IOManager,
 		eventBus:  cfg.EventBus,
 		logger:    log.Default(),
+		pluginMgr: cfg.PluginMgr,
 	}
 }