feat(plugins): 访问控制在插件页配置 + 修复 active 仪表在周期视图显示 0

## 插件管理页（用户要求：权限不要只放 config.yaml）

插件页新增两列（可见性、端点）和一块访问控制编辑器，可直接改：
- 每个插件的整体可见性（跟随插件 / 仅 admin / 仅 user / admin+user / 所有人）
- 每个注册端点的可访问角色与密钥（admin, user, @homeagent, public）

原先这些能力后端齐全但 WebUI 零入口，唯一改法是手改 config.yaml。

## 修掉的三个真缺陷

1. endpointAccess 读错了 override 的键
   SetEndpointAccess 按 plugin#path 存，endpointAccess 却读 plugin 级。
   后果：改了权限后 UI 仍显示插件声明的角色，再保存一次就把限制悄悄撤销。
   鉴权一直是对的，只有显示和往返是坏的 —— 所以之前没被发现。

2. override 只在内存里
   内存 map 让"billing 仅 admin"看着生效，直到下次重启限制凭空消失，
   日志里没有任何线索。现在落盘到 plugin_dir/.access.json，
   插件升级覆盖 .state.json 也不会连带放宽访问。删掉最后一个 override 就删文件，
   "没有覆盖"用文件不存在来诚实表达。

3. 可见性列表泄漏内部键
   端点 override 与插件可见性共用一个 map，UI 因此会看到 "probe#hello"
   并可能把它当 audience 存回去。现在按已注册端点集合过滤。

另外把整体可见性接到同一条 /access 通路（path 用 *），并修了可见性下拉的
集合比较：服务端原样存 "admin, user"，而选项是 "user,admin"，不相等就会
显示"跟随插件"，用户一保存就把访问范围放宽回插件声明 —— 比显示错更糟。

## 活跃请求：三个视图显示 0

active 是实时仪表，没有日历周期可过滤，但周期响应压根没带这个字段。
前端 `st.active || 0` 于是把"字段缺失"变成了一句自信的"0 活跃"，
而 all 视图（响应里有该字段）显示真值 —— 三个视图 0、总视图正常。
现在周期响应带上 active，前端去掉 || 0 回退：缺失显示 — 而不是假装是 0。

判据：四个 period 都断言 active 存在且为数字；变异去掉字段即变红。
生产实测 day/week/month/all 均为 4。

Co-Authored-By: ModelRouter <noreply@modelrouter.dev>
(cherry picked from commit 120ba9e957)

internal/lua/plugin_http_handler.go

@@ -354,29 +354,25 @@ type HTTPEndpointAccess struct {
 func (ps *Plugins) endpointAccess() []HTTPEndpointAccess {
 	ps.mu.RLock()
 	defer ps.mu.RUnlock()
+	return ps.endpointAccessLocked()
+}
+
+// endpointAccessLocked is the body of endpointAccess for callers that already
+// hold ps.mu — VisibilityOverrides walks the same map and must not re-lock.
+func (ps *Plugins) endpointAccessLocked() []HTTPEndpointAccess {
 	var out []HTTPEndpointAccess
 	for _, p := range ps.plugins {
 		if p.http == nil || p.LoadError != "" {
 			continue
 		}
-		ov := ps.visibility[p.Info.Name]
-		var ovRoles, ovKeys []string
-		if ov != "" {
-			for _, part := range strings.Split(ov, ",") {
-				part = strings.TrimSpace(part)
-				if part == "" {
-					continue
-				}
-				// A key name is anything that is not a role: the override string
-				// carries both, so "@name" marks a key and a bare word a role.
-				if strings.HasPrefix(part, "@") {
-					ovKeys = append(ovKeys, strings.TrimPrefix(part, "@"))
-				} else {
-					ovRoles = append(ovRoles, part)
-				}
-			}
-		}
 		for _, h := range p.http {
+			// The override key is per ENDPOINT (plugin#path), not per plugin.
+			// Reading the plugin-level key here reported the plugin's own
+			// audience override as if it governed every endpoint, and reported
+			// no endpoint override at all — so the UI drew the DECLARED roles
+			// after an operator had saved a change, and re-saving from that
+			// display silently reverted the restriction.
+			ovRoles, ovKeys := splitAccessSpec(ps.visibility[endpointOverrideKey(p.Info.Name, h.Path)])
 			out = append(out, HTTPEndpointAccess{
 				Plugin: p.Info.Name, Path: h.Path, FullPath: h.routePath(),
 				Method: h.Method, Handler: h.Handler,
@@ -422,9 +418,10 @@ func (ps *Plugins) SetEndpointAccess(plugin, path, spec string) error {
 	key := endpointOverrideKey(plugin, path)
 	if strings.TrimSpace(spec) == "" {
 		delete(ps.visibility, key)
-		return nil
+	} else {
+		ps.visibility[key] = spec
 	}
-	ps.visibility[key] = spec
+	ps.saveAccessOverridesLocked()
 	return nil
 }
 
@@ -509,3 +506,25 @@ func (ps *Plugins) ValidateAccessSpec(spec string) error {
 	}
 	return nil
 }
+
+// splitAccessSpec turns an override string into role and key lists. "@name" is a
+// key; a bare word is a role. Shared by the reporting path and the enforcement
+// path so the two can never disagree about what an override means.
+func splitAccessSpec(spec string) (roles, keys []string) {
+	if strings.TrimSpace(spec) == "" {
+		return nil, nil
+	}
+	for _, part := range strings.Split(spec, ",") {
+		part = strings.TrimSpace(part)
+		switch {
+		case part == "", part == "public":
+			// "public" is an enforcement concern, not a listing; it is reported
+			// via the Public field.
+		case strings.HasPrefix(part, "@"):
+			keys = append(keys, strings.TrimPrefix(part, "@"))
+		default:
+			roles = append(roles, part)
+		}
+	}
+	return roles, keys
+}