feat(gui): WebUI 与 Electron 壳的插件安装/删除/禁用/编辑

## WebUI：新增「插件」页
- 列表来自 on_disk（不是 loaded 集合）——**加载失败的插件也必须显示并带错误**，
  否则一个语法错误看起来和"插件没装"完全一样
- 启用/禁用（PUT {"enabled":bool}）、删除、编辑源码、安装/覆盖
- 显示 hook_errors：插件抛异常在别处毫无痕迹，没有这一栏的症状就是
  "功能就是不work"
- 插到 dropzone 与代码编辑器都做了泛型化（bindDropzone / openCodeModal），
  适配器与插件共用一份，而不是复制第二份只改 4 个 id 的函数

## TABS 收敛为单一常量
tab 清单原本是字面量散在三处：goTab、refresh()、admin-only 隐藏列表。
加一个 tab 意味着三处都要记得改，漏一处就是"路由认得但界面不显示"——
和今天早些时候 chain_step 漏报同一类静默缺口。现在只有 const TABS。

## Electron 壳：设置面板里的插件管理
渲染进程不能直连内嵌核心（没有 key、不知道端口），所以走 IPC：
  renderer → plugins:proxy → main → HTTP /api/plugins
代理是 (method, path, body) 透传而不是固定命令表：固定表每加一个端点就要扩，
而"按钮存在但什么都不做"比"没有这个按钮"更糟。透传让渲染层能调用核心将来
新增的任何 /api/plugins 路由，路径在主进程校验。

## ★ GUI 此前零测试，而本次改动就引入了三类"看起来没事"的问题
1. 引用了不存在的 CSS 类（.tag / .sm）——渲染成无样式文本
2. 引用了不存在的 helper（esc / escAttr）——那是 WebUI 的，renderer/app.js
   是独立文档，点击时 ReferenceError
3. .ghost/.primary 只在 .form .actions 作用域内生效，插件按钮在 .pl-acts 里
   于是是无样式裸按钮

补 4 个静态判据（不启动 Electron，守卫的正是"打开应用才看得见"那一类）：
  TestGUICSSClassesExist          用到的类必须在样式表里定义
  TestGUIHelperFunctionsAreDefined 被调用的函数必须有定义
  TestGUIPluginPanelIsReachable  面板在 overlay 内、按钮已绑定、打开设置会加载
  TestGUIIPCPathIsConstrained    代理必须限定 /api/plugins 前缀并拒绝路径穿越

写第一个判据时我错了三次：CSS 解析器先丢最后一个 selector、再把变量块当
selector、最后漏掉复合选择器（.tb-btn.tb-close）。两次"判据自己坏了"的
教训和本项目一贯一致——**判据出错的信号是它报了一个假问题**。现在改用宽松的
token 提取 + 显式的 guiKnownUnstyled 豁免表（blob/tgl/rail 是既有无样式类，
不是本次引入，失败它们只会让判据对新工作失去意义）。

## 变异验证
  改坏唯一的 CSS 定义（.pl-empty）→ TestGUICSSClassesExist 红
  改坏 helper 名 → TestGUIHelperFunctionsAreDefined 红
★ 第一次变异我改了 .pl-broken，判据**正确地没报**——因为它还被另一条规则定义。
  这是变异选错目标，不是判据有洞；换 .pl-empty 后如期变红。

363 个测试全绿。

internal/gateway/ui_plugin_test.go

@@ -156,3 +156,107 @@ func TestUIPluginInjectionFailureIsNonFatal(t *testing.T) {
 			"leaving the dashboard blank")
 	}
 }
+
+// ---- plugin management UI contract ---------------------------------------
+//
+// The management page is the operator's only way to take a broken plugin out
+// of the request path. Every one of these assertions guards a link that, if it
+// silently broke, would leave the gateway running with a plugin it cannot
+// disable — the worst kind of gap: everything looks fine and nothing is
+// reachable.
+
+func TestUIHasPluginTabAndPane(t *testing.T) {
+	src := uiSourceX(t)
+	if !strings.Contains(src, `data-tab="plugins"`) {
+		t.Error("no sidebar entry for the plugin page")
+	}
+	if !strings.Contains(src, `id="tab-plugins"`) {
+		t.Error("no #tab-plugins pane")
+	}
+	// The tab list is now a single constant; a new tab must be added there or
+	// goTab will not un-hide its pane.
+	if !strings.Contains(src, `const TABS = [`) {
+		t.Error("TABS is gone; the tab list went back to a duplicated literal")
+	}
+	for _, tn := range []string{"status", "chat", "keys", "sort", "sources", "adapters", "plugins"} {
+		if !strings.Contains(src, `"`+tn+`"`) {
+			t.Errorf("TABS is missing %q", tn)
+		}
+	}
+	// goTab must iterate TABS, not its own list.
+	if !strings.Contains(src, "TABS.forEach((tn) =>") {
+		t.Error("goTab does not iterate TABS")
+	}
+	if strings.Contains(src, `["status", "chat", "keys", "sort", "sources", "adapters"].forEach`) {
+		t.Error("a duplicated tab literal survived; it will drift from TABS")
+	}
+}
+
+func TestUIRendersPluginManagement(t *testing.T) {
+	src := uiSourceX(t)
+	body, ok := jsFunctionBody(src, "renderPlugins")
+	if !ok {
+		t.Fatal("renderPlugins() not found")
+	}
+	// It must read the DISK listing, not just the loaded set: a plugin that
+	// failed to compile is absent from the loaded set, and showing only the
+	// loaded set makes a syntax error look like "the plugin is not installed".
+	if !strings.Contains(body, "on_disk") {
+		t.Error("renderPlugins reads only the loaded set; a failed plugin would " +
+			"be invisible instead of shown with its error")
+	}
+	if !strings.Contains(body, "/api/plugins") {
+		t.Error("renderPlugins does not call /api/plugins")
+	}
+	// Hook errors must be surfaced: a plugin that throws in every stage leaves
+	// no other trace, so without this the symptom is "the feature just doesn't
+	// work".
+	if !strings.Contains(body, "hook_errors") {
+		t.Error("renderPlugins ignores hook_errors; a silently broken plugin is undebuggable")
+	}
+	// Enable / disable / remove / edit.
+	for _, fn := range []string{"togglePlugin", "delPlugin", "installPlugin", "editPlugin"} {
+		if _, ok := jsFunctionBody(src, fn); !ok {
+			t.Errorf("%s() is missing from the WebUI", fn)
+		}
+	}
+	// The toggle must go through the enable/disable endpoint, not delete.
+	tb, ok := jsFunctionBody(src, "togglePlugin")
+	if !ok {
+		t.Fatal("togglePlugin() missing")
+	}
+	if !strings.Contains(tb, `method: "PUT"`) {
+		t.Error("togglePlugin does not use PUT")
+	}
+	if !strings.Contains(tb, "enabled:") {
+		t.Error("togglePlugin does not send an \"enabled\" field")
+	}
+	// And the admin-only tab list must include plugins, or a non-admin would
+	// see a page whose every action 403s.
+	if !strings.Contains(src, `["sort", "sources", "adapters", "plugins"]`) {
+		t.Error("the admin-only tab list omits \"plugins\"; a user key would see a " +
+			"page full of actions that all fail with 403")
+	}
+}
+
+// TestUIBindDropzoneIsParameterised guards the refactor: the adapter and plugin
+// upload forms share one dropzone, so a hard-coded id would send a dropped
+// plugin file into the adapter name field.
+func TestUIBindDropzoneIsParameterised(t *testing.T) {
+	src := uiSourceX(t)
+	body, ok := jsFunctionBody(src, "bindDropzone")
+	if !ok {
+		t.Fatal("bindDropzone() not found")
+	}
+	if strings.Contains(body, `$("#dz")`) || strings.Contains(body, `$("#adp-name")`) {
+		t.Error("bindDropzone still hard-codes the adapter's element ids; the " +
+			"plugin form would write into the adapter form")
+	}
+	if !strings.Contains(body, "dzId") || !strings.Contains(body, "nameSel") {
+		t.Error("bindDropzone does not accept the ids to bind")
+	}
+	// Both forms must call it.
+	if !strings.Contains(src, `bindDropzone("pl-dz", "pl-file", "#pl-name", "#pl-code")`) {
+		t.Error("the plugin upload form does not use the parameterised dropzone")
+	}
+}