refactor(lua): 内核回归六项职责 —— 登录/浏览器全部移入插件

用户钉死了内核的职责边界，本提交把越界部分全部拆除：

  内核只做：加载适配器 · auto 调度 · 加载插件 · 调度插件 · 维护源与 key · 签发密钥

## 架构纠正（用户指出的根本错误）

我此前把信任模型弄反了。实测：插件 VM 的 os.execute/io.popen/package 全部可达
(true,true,true) —— 插件从来不是 OS 级沙箱。正确的边界是：

  插件   可信（运维安装），非沙箱，有完整 OS 能力 → 平台知识/登录/浏览器归它
  适配器 不可信（可被动态安装），请求级 → 沙箱归它（12 个内置适配器实测均不碰
         os/io/package，后续沙箱化零风险，属独立一步）

## 删除（内核越界部分）

- plugin_browser.go        内核浏览器管理器（Xvfb/chromium/x11vnc/websockify
                           进程栈、回环监听器）—— 388 行全删，浏览器由插件用
                           os.execute 自己拉起（实测 spawn+reap 闭环可用）
- plugin_login.go          登录会话状态机 + LoginFlow 枚举 + VNC 全局门禁
                           —— 457 行全删。"登录"从内核概念中消失
- gateway/browser_proxy.go viewer 反代
- handlePluginLogin API    登录会话列表端点
- vnc_enabled 全局开关     改为 per-plugin 授权（见下）

## 新增（内核职责内的通用机制，无任何登录/浏览器语义）

- plugin_outbound.go       通用额外出站主机授权：插件声明 plugin.hosts（请求）
                           → 运维在设置页逐个批准（授权）。与 kernel actions
                           同一"声明≠授权"模型。内核只知道白名单加减，不知道
                           host 被用来干什么
- on_unload 生命周期钩子   卸载是"调度插件"的一部分：内核在关闭插件状态前调用
                           插件导出的 on_unload，让它自清理外部资源。内核不知道
                           资源是什么（进程/句柄/远端会话都行）。带进程回收回归
                           测试 TestOnUnloadReapsPluginProcesses

## channels.lua 全量接管

- 登录会话自持：plugin.state.sessions（nonce 只在 begin 响应出现一次，
  惰性过期清理）
- 服务端浏览器栈自持：spawnBrowser 用 io.popen 拉起 Xvfb/chromium/x11vnc/
  websockify 并记 pid，reapBrowser 回收；on_unload 兜底
- 优先级阶梯（用户指定）：① 本机浏览器（给 URL）→ ② 自动化（轮询/nonce 回调）
  → ③ VNC 无头浏览器兜底（无浏览器系统/自动化无法完成的场景，如回环重定向
  必须落在服务端）
- plugin.auth_hosts → plugin.hosts（语义泛化：出站主机授权与登录无关）

## 验收

- 全仓旧符号零残留（grep 权威确认，代码+注释+lua+测试）
- 内核非测试代码零厂商名
- build + vet 全绿；lua/core/gateway/types/scheduler/provider 全量测试通过
- channels 端到端（登录→凭据→add_source→模型可见）继续通过

internal/lua/plugins.go

@@ -244,9 +244,10 @@ type Plugin struct {
 	// was supposed to inherit from.
 	persisted bool
 
-	// AuthHosts lists the login hosts this plugin declared (`plugin.auth_hosts`).
-	// A REQUEST, not a grant: the operator approves in settings.
-	AuthHosts []string
+	// ExtraHosts lists outbound hosts this plugin declared in its own source
+	// (`plugin.hosts`) beyond the operator-configured sources. A REQUEST, not a
+	// grant: the operator approves each one in the settings page.
+	ExtraHosts []string
 
 	// KernelDeclared lists the kernel actions this plugin asks for in its own
 	// source (`plugin.kernel = {...}`). It is a REQUEST, shown to the operator
@@ -311,24 +312,12 @@ type Plugins struct {
 	// what a plugin DECLARES it wants (Plugin.KernelDeclared): a declaration is
 	// a request, a grant is a privilege. Persisted in .access.json.
 	kernelPerms kernelPermissionSet
-	// loginStore holds in-flight login sessions (see plugin_login.go). Lazy so a
-	// Plugins built without construction still works.
-	loginStore *loginSessions
-	loginOnce  sync.Once
-	// browserStore owns server-side browser sessions (plugin_browser.go). Lazy
-	// for the same reason as loginStore.
-	browserStore *browserSupervisor
-	browserOnce  sync.Once
 	// sourceHosts remembers the source-derived allowlist so a rebuild can fold it
 	// together with any granted login hosts.
 	sourceHosts []string
-	// authHosts is the per-plugin set of APPROVED login hosts. Separate from what
-	// a plugin declared (Plugin.AuthHosts): a declaration is a request.
-	authHosts map[string][]string
-	// vncPermitted gates the VNC login escape hatch. Off by default: a
-	// server-side browser is the highest-risk login path and must be an
-	// operator's deliberate choice, not a default.
-	vncPermitted bool
+	// extraHosts is the per-plugin set of APPROVED extra outbound hosts. Separate
+	// from what a plugin declared (Plugin.ExtraHosts): a declaration is a request.
+	extraHosts map[string][]string
 	// save coalesces state writes into one background goroutine.
 	//
 	// A hook must NOT write synchronously: the billing plugin mutates state on
@@ -541,8 +530,8 @@ func (ps *Plugins) DisableStatePersistence() { ps.stateDirDisabled = true }
 func (ps *Plugins) SetOutboundHosts(hosts []string) {
 	ps.mu.Lock()
 	defer ps.mu.Unlock()
-	// Remembered so a later auth-host grant can rebuild the allowlist as
-	// sources ∪ granted-login-hosts instead of losing the source half.
+	// Remembered so a later extra-host grant can rebuild the allowlist as
+	// sources ∪ granted-extra-hosts instead of losing the source half.
 	ps.sourceHosts = append([]string(nil), hosts...)
 	ps.rebuildOutboundAllowlistLocked()
 }
@@ -660,9 +649,6 @@ func bootPluginState(code, name string, allow *httpAllowlist, ps *Plugins) (*wor
 		// the kernel.
 		registerSecretBridge(L, ps, name)
 		registerKernelBridge(L, ps, name)
-		// R4-e: login sessions. Same scoping reason as the rest — an adapter
-		// shares setupGlobals and must not be able to start a login.
-		registerLoginBridge(L, ps, name)
 	}
 	if err := L.DoString(code); err != nil {
 		L.Close()
@@ -804,11 +790,11 @@ func (ps *Plugins) LoadSource(name, code string) error {
 	p.KernelDeclared = readPluginKernelDeclared(w.L)
 	w.L.SetTop(0)
 
-	// ---- declared login hosts ----
-	// Login flows reach hosts that are not sources (auth.example.com), which the
-	// outbound allowlist blocks by default. A plugin declares what it needs; the
-	// operator approves. See plugin_login.go.
-	p.AuthHosts = readPluginAuthHosts(w.L)
+	// ---- declared extra hosts ----
+	// Some plugins need hosts that are not sources (account portals, claim
+	// endpoints), which the outbound allowlist blocks by default. The plugin
+	// declares what it needs; the operator approves each host. See plugin_outbound.go.
+	p.ExtraHosts = readPluginExtraHosts(w.L)
 	w.L.SetTop(0)
 
 	// ---- http endpoints ----
@@ -1891,8 +1877,27 @@ func (ps *Plugins) Unload(name string) error {
 		ps.rebuild()
 		return nil
 	}
+	// Lifecycle hook: if the plugin exported on_unload, call it BEFORE closing
+	// the state. This is generic plugin lifecycle (part of "调度插件"), not any
+	// feature: a plugin that spawned OS processes or holds other external
+	// resources is the one that knows how to release them, and Unload is the
+	// only guaranteed point where it still can. Best-effort by design — a
+	// hook that errors must not block an unload the operator explicitly asked
+	// for (a wedged plugin has its own path above).
 	p.mu.Lock()
 	if p.state != nil && p.state.L != nil {
+		p.state.L.GetGlobal(pluginGlobal)
+		if L := p.state.L; L.Type(-1) == golua.LUA_TTABLE {
+			L.GetField(-1, "on_unload")
+			if L.Type(-1) == golua.LUA_TFUNCTION {
+				if err := callFnOn(L, "on_unload"); err != nil {
+					log.Printf("[plugins] %s: on_unload: %v", name, err)
+				}
+			}
+			L.Pop(2) // adapter/plugin table + field remnant
+		} else {
+			L.Pop(1)
+		}
 		p.state.L.Close()
 		p.state = nil
 	}