feat: phase 3 - field-level permissions with plugin field definitions, service-layer filtering, 20 core field definitions

app/plugins/manifest.py

@@ -15,6 +15,15 @@ class PluginRouteDef(BaseModel):
     )
 
 
+class FieldDefinition(BaseModel):
+    """Field definition for field-level permissions."""
+
+    module: str = Field(..., description="Module name (e.g. 'companies', 'contacts')")
+    field: str = Field(..., description="Field name (e.g. 'annual_revenue')")
+    label: str = Field(..., description="Human-readable label")
+    sensitivity: str = Field(default="normal", description="normal|sensitive|critical")
+
+
 class PluginManifest(BaseModel):
     """Manifest describing a plugin's metadata, dependencies, and capabilities."""
 
@@ -42,6 +51,9 @@ class PluginManifest(BaseModel):
     is_core: bool = Field(
         default=False, description="Whether this is a core plugin that cannot be deactivated"
     )
+    field_definitions: list[FieldDefinition] = Field(
+        default_factory=list, description="Field definitions for field-level permissions"
+    )
 
     @field_validator("name")
     @classmethod