feat!: resolve catalog plugins from the @data-fair registry

[albanm]

Catalog plugins are now resolved from the central @data-fair/registry instead of a local plugins volume. The admin "install plugins" page is removed; plugin management lives in the registry.

What changes

• API + worker: new privateRegistryUrl / secretKeys.registry config; both services call ensureArtefact to download + cache plugin tarballs on demand. The plugins volume becomes read-only and only for the v1.0.0 boot migration.
• API surface: POST /api/plugins, DELETE /api/plugins/:id, GET /api/plugins, GET /api/plugins/:id/thumbnail, GET /api/plugins-registry are all gone. GET /api/plugins/:id now returns the registry-resolved descriptor.
• UI: the catalogs and create-catalog pages list plugins straight from /registry/api/v1/artefacts (same domain, browser session cookie). Thumbnails come from /registry/api/v1/thumbnails/:id/data. The /admin/plugins page is deleted.
• Migration: upgrade/1.0.0/01-publish-plugins-to-registry.ts walks the legacy <dataDir>/plugins directory, repacks each plugin into an npm-style tarball (forcing license: AGPL-3.0-only), publishes it to the registry as public: true, and best-effort uploads the in-tarball thumbnail and localized title/description. Idempotent (skips artefacts already uploaded).
• Dev env: new registry service in docker-compose.yml, proxied under /registry/ by nginx, with a REGISTRY_PORT slot in .env.

Why

Centralizes plugin distribution and access control in the registry — operators stop shipping plugins per catalogs deployment, and the registry's per-account access rules become the single source of truth.

Regression risks (please review)

• dataDir is now optional (defaults to null). Existing deployments that previously mounted /app/data must keep DATA_DIR set for the v1.0.0 boot to find and republish their legacy plugins; once the migration succeeds the env var can be removed. Worth calling out in the release notes.
• Volume health check at api/src/admin/status.ts:8 silently returns OK when dataDir is unset. Cosmetic regression in /api/admin/status for ops dashboards.
• Worker error path at worker/src/worker.ts:128-152 now catches any registry exception (not just 404/403) and marks the task error. Previously only a missing import did. A registry hiccup will permanently fail tasks until an operator retries — confirm this matches the intended behaviour.
• Catalog creation UX: pages/catalogs/new.vue fetches /api/plugins/:id under the session account, but the catalog is created under newOwner. If a user picks a plugin they can access but their selected owner cannot, the create call 403s at the very end. UX recovers but the picker doesn't pre-filter.
• Port fallbacks diverge: tests/support/registry.ts falls back to port 5601, while api/config/development.mjs and worker/config/development.mjs fall back to 8089, and .env uses RANDOM_NB + 33. Only the .env value works; tests run outside the worktree env will hit the wrong port silently.
• Worker doesn't ensureDirSync(registryCacheDir) (the API does). Relies on ensureArtefact to create the cache directory. If that ever changes, the first task fails.
• Worker debug log loses the resolved plugin version (Using plugin ${catalog.plugin} only). Minor observability regression.

Out of scope (deliberately deferred)

• The legacy <dataDir>/plugins directory is left in place after migration for manual reconciliation. A separate v2.0.0 cleanup will remove dataDir entirely.