feat: milestone 5b — frontend bundle host + VerstakPluginAPI stub

- Bundle contract: window.VerstakPluginRegister(id, {components: {...}})
- PluginBundleHost.svelte: loads bundle via GetPluginAssetContent, mounts components
- VerstakPluginAPI.js: restricted API (capabilities, events, settings, commands — all stub)
- ViewContainer: PluginBundleHost replaces placeholder when frontend bundle exists
- PluginManager: settings panel via PluginBundleHost (removed hardcoded form)
- Backend: GetPluginFrontendInfo, GetPluginAssetContent with path security
- Security: reject absolute paths, path traversal, escape from plugin root
- Error boundary: bundle load/execute/mount errors show fallback, not crash
- Tests: 11 backend tests (asset API), frontend bundle checks in smoke
- Docs: bundle contract, VerstakPluginAPI, security constraints

frontend/wailsjs/go/api/App.d.ts

@@ -27,6 +27,10 @@ export function GetCurrentWorkspaceNode():Promise<Record<string, any>>;
 
 export function GetPermissions():Promise<Array<permissions.Entry>>;
 
+export function GetPluginAssetContent(arg1:string,arg2:string):Promise<string|string>;
+
+export function GetPluginFrontendInfo(arg1:string):Promise<Record<string, any>>;
+
 export function GetPlugins():Promise<Array<plugin.Plugin>>;
 
 export function GetVaultPluginState():Promise<Record<string, any>>;

frontend/wailsjs/go/api/App.js

@@ -46,6 +46,14 @@ export function GetPermissions() {
   return window['go']['api']['App']['GetPermissions']();
 }
 
+export function GetPluginAssetContent(arg1, arg2) {
+  return window['go']['api']['App']['GetPluginAssetContent'](arg1, arg2);
+}
+
+export function GetPluginFrontendInfo(arg1) {
+  return window['go']['api']['App']['GetPluginFrontendInfo'](arg1);
+}
+
 export function GetPlugins() {
   return window['go']['api']['App']['GetPlugins']();
 }