refactor(lua): 内核回归六项职责 —— 登录/浏览器全部移入插件

用户钉死了内核的职责边界，本提交把越界部分全部拆除：

  内核只做：加载适配器 · auto 调度 · 加载插件 · 调度插件 · 维护源与 key · 签发密钥

## 架构纠正（用户指出的根本错误）

我此前把信任模型弄反了。实测：插件 VM 的 os.execute/io.popen/package 全部可达
(true,true,true) —— 插件从来不是 OS 级沙箱。正确的边界是：

  插件   可信（运维安装），非沙箱，有完整 OS 能力 → 平台知识/登录/浏览器归它
  适配器 不可信（可被动态安装），请求级 → 沙箱归它（12 个内置适配器实测均不碰
         os/io/package，后续沙箱化零风险，属独立一步）

## 删除（内核越界部分）

- plugin_browser.go        内核浏览器管理器（Xvfb/chromium/x11vnc/websockify
                           进程栈、回环监听器）—— 388 行全删，浏览器由插件用
                           os.execute 自己拉起（实测 spawn+reap 闭环可用）
- plugin_login.go          登录会话状态机 + LoginFlow 枚举 + VNC 全局门禁
                           —— 457 行全删。"登录"从内核概念中消失
- gateway/browser_proxy.go viewer 反代
- handlePluginLogin API    登录会话列表端点
- vnc_enabled 全局开关     改为 per-plugin 授权（见下）

## 新增（内核职责内的通用机制，无任何登录/浏览器语义）

- plugin_outbound.go       通用额外出站主机授权：插件声明 plugin.hosts（请求）
                           → 运维在设置页逐个批准（授权）。与 kernel actions
                           同一"声明≠授权"模型。内核只知道白名单加减，不知道
                           host 被用来干什么
- on_unload 生命周期钩子   卸载是"调度插件"的一部分：内核在关闭插件状态前调用
                           插件导出的 on_unload，让它自清理外部资源。内核不知道
                           资源是什么（进程/句柄/远端会话都行）。带进程回收回归
                           测试 TestOnUnloadReapsPluginProcesses

## channels.lua 全量接管

- 登录会话自持：plugin.state.sessions（nonce 只在 begin 响应出现一次，
  惰性过期清理）
- 服务端浏览器栈自持：spawnBrowser 用 io.popen 拉起 Xvfb/chromium/x11vnc/
  websockify 并记 pid，reapBrowser 回收；on_unload 兜底
- 优先级阶梯（用户指定）：① 本机浏览器（给 URL）→ ② 自动化（轮询/nonce 回调）
  → ③ VNC 无头浏览器兜底（无浏览器系统/自动化无法完成的场景，如回环重定向
  必须落在服务端）
- plugin.auth_hosts → plugin.hosts（语义泛化：出站主机授权与登录无关）

## 验收

- 全仓旧符号零残留（grep 权威确认，代码+注释+lua+测试）
- 内核非测试代码零厂商名
- build + vet 全绿；lua/core/gateway/types/scheduler/provider 全量测试通过
- channels 端到端（登录→凭据→add_source→模型可见）继续通过

internal/gateway/plugins_api.go

@@ -106,7 +106,7 @@ func (g *Gateway) handlePluginsAPI(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// /api/plugins/{name}/kernel — the operator's view of, and edit surface for,
-	// which kernel actions a plugin may call, plus its declared login hosts.
+	// which kernel actions a plugin may call, plus its declared extra outbound hosts.
 	if strings.HasSuffix(path, "/kernel") {
 		name := strings.TrimSuffix(path, "/kernel")
 		if name == "" {
@@ -117,17 +117,9 @@ func (g *Gateway) handlePluginsAPI(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// /api/plugins/{name}/login — in-flight login sessions for the settings page
-	// (the page polls these while the operator completes a sign-in elsewhere).
-	if strings.HasSuffix(path, "/login") {
-		name := strings.TrimSuffix(path, "/login")
-		if name == "" {
-			writeError(w, http.StatusBadRequest, "invalid_request", "plugin name required")
-			return
-		}
-		g.handlePluginLogin(w, r, name)
-		return
-	}
+	// /api/plugins/{name}/login — REMOVED. Login sessions are plugin domain:
+	// channels.lua owns its own session state and serves it through its own
+	// mount. The kernel has no login concept.
 
 	// /api/plugins/{name}/call/{fn}
 	if i := strings.Index(path, "/call/"); i >= 0 {
@@ -643,7 +635,7 @@ func (g *Gateway) handlePluginVisibility(w http.ResponseWriter, r *http.Request,
 }
 
 // handlePluginKernel is the operator's surface for a plugin's kernel grants and
-// declared login hosts.
+// declared extra outbound hosts.
 //
 // GET returns what the plugin DECLARED beside what was GRANTED. That pairing is
 // the point of the endpoint: a plugin declaring `add_source` is a request, and
@@ -673,18 +665,18 @@ func (g *Gateway) handlePluginKernel(w http.ResponseWriter, r *http.Request, nam
 			"declared": declared,
 			"granted":  perm.Actions,
 			"all_read": perm.AllRead,
-			// Login hosts: declared vs granted, same request/privilege split.
-			"auth_hosts_declared": ps.PluginAuthHosts(name),
-			"auth_hosts_granted":  ps.AuthHostsGranted()[name],
-			"vnc_enabled":         ps.VNCEnabled(),
+			// Extra outbound hosts: declared vs granted, same request/privilege
+			// split as kernel actions. What the plugin does with a host (login,
+			// claim quotas...) is plugin business — the kernel only bounds egress.
+			"hosts_declared": ps.PluginExtraHosts(name),
+			"hosts_granted":  ps.ExtraHostsGranted()[name],
 		})
 		return
 	case http.MethodPut, http.MethodPost:
 		var body struct {
-			Actions   []string `json:"actions"`
-			AllRead   bool     `json:"all_read"`
-			AuthHosts []string `json:"auth_hosts"`
-			VNC       *bool    `json:"vnc_enabled"`
+			Actions []string `json:"actions"`
+			AllRead bool     `json:"all_read"`
+			Hosts   []string `json:"hosts"`
 		}
 		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
@@ -694,40 +686,15 @@ func (g *Gateway) handlePluginKernel(w http.ResponseWriter, r *http.Request, nam
 			writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 			return
 		}
-		if body.AuthHosts != nil {
-			if err := ps.GrantAuthHosts(name, body.AuthHosts); err != nil {
+		if body.Hosts != nil {
+			if err := ps.GrantExtraHosts(name, body.Hosts); err != nil {
 				writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
 				return
 			}
 		}
-		if body.VNC != nil {
-			ps.SetVNCEnabled(*body.VNC)
-		}
 		writeJSON(w, http.StatusOK, map[string]interface{}{"ok": true})
 		return
 	default:
 		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "GET or PUT")
 	}
 }
-
-// handlePluginLogin lists a plugin's in-flight login sessions so the settings
-// page can show "waiting for you to finish signing in" and the URL to open.
-func (g *Gateway) handlePluginLogin(w http.ResponseWriter, r *http.Request, name string) {
-	ps := g.core.Plugins()
-	if ps == nil {
-		writeError(w, http.StatusNotFound, "not_found", "no plugins loaded")
-		return
-	}
-	if reqRole(r.Context()) != "admin" {
-		writeError(w, http.StatusForbidden, "forbidden", "admin role required")
-		return
-	}
-	if r.Method != http.MethodGet {
-		writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "GET")
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{
-		"sessions":    ps.ListLogins(name),
-		"vnc_enabled": ps.VNCEnabled(),
-	})
-}