feat: add simple browser-only custom charts

[Bl3f]

Summary

• rebuild custom chart plugins as authenticated, browser-only modules
• discover flat project plugins without global cache or server-side execution
• hot-reload active charts through lightweight manifest polling
• keep stories, exports, automations, MCP, and messaging on built-in charts
• add project-isolation/security tests, a starter chart, and authoring guidance

Design

This starts fresh from #945 and removes the headless Chromium, SSRF proxy, SSE watcher, cross-project registry state, and server rendering paths that drove most review feedback. Plugin metadata is optional JSON beside the JavaScript module, and plugin code is served only through project-protected tRPC queries.

Validation

• backend chart/prompt/capability tests: 19 passed
• shared chart/story tests: 34 passed; full shared suite: 260 passed
• full frontend suite: 36 passed
• frontend production build passed
• full TypeScript, ESLint, and formatting checks passed
• full backend suite: 511 passed, with 2 unrelated existing OIDC allowlist assertion failures

  

[github-actions]

🧹 Preview Removed

The preview deployment for this PR has been cleaned up.

[cubic-dev-ai]

All reported issues were addressed across 33 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

🚀 Preview Deployment

URL	https://pr-1242-cb157c8.preview.getnao.io
Commit	cb157c8

⚠️ No LLM API keys configured - you'll see the API key setup flow when trying to chat.

---

_{Preview will be automatically removed when this PR is closed.}