fix(arch-001,arch-002): permissions before on_activate; activate once per process

app/plugins/registry.py

@@ -608,6 +608,22 @@ class PluginRegistry:
         for warning in perm_warnings:
             logger.warning(warning)
 
+        # Register permissions and entity models BEFORE on_activate (ARCH-001 fix):
+        # the activation hook may already rely on its own permissions/entities being
+        # resolvable (e.g. tools declaring required_permission).
+        from app.core.permission_registry import (
+            get_permission_registry,
+            register_plugin_permissions,
+        )
+
+        if plugin.manifest.permissions:
+            register_plugin_permissions(name, plugin.manifest.permissions)
+        get_permission_registry()._active_plugins.add(name)
+        for entity_type, model_class in plugin.get_entity_models().items():
+            from app.services.entity_permission_service import register_entity_model
+
+            register_entity_model(entity_type, model_class)
+
         # Call on_activate hook (registers event listeners)
         await plugin.on_activate(db, self._container, self._event_bus)