Phase 3: Plugin-UI-System (WordPress-Style)

Backend:
- PluginManifest um 5 neue UI-Felder erweitert: menu_items, page_routes,
  detail_tabs, settings_pages, dashboard_widgets (FrontendMenuItem,
  FrontendPageRoute, FrontendDetailTab, FrontendSettingsPage,
  FrontendDashboardWidget)
- GET /api/v1/plugins/active-manifests Endpoint liefert UI-Manifeste
  aller aktiven Plugins
- Registry.get_active_manifests() + PluginService.get_active_manifests()
- 12 Built-in Plugins mit UI-Manifest-Daten gefuellt (menu_items,
  page_routes, detail_tabs, settings_pages)
- Plugin-Install-System: POST /upload (ZIP), POST /install-url (URL)
  mit Validierung (Manifest, dangerous imports, SQL migrations)

Frontend:
- pluginStore.ts (Zustand) mit PluginUiManifest Typen + Selektoren
- useActivePluginManifests() React Query Hook
- PluginRegistry.tsx — fetcht Manifeste beim App-Start
- PluginLoader.tsx — dynamisches React.lazy() mit ErrorBoundary
- PluginRouteRenderer.tsx — Catch-all fuer Plugin-Routes
- routes/index.tsx — Catch-all Routes fuer Plugin-Pages + Settings
- Sidebar.tsx — dynamische Plugin Menu-Items mit Grouping + Icons
- Settings.tsx — dynamische Plugin Settings-Pages
- ContactDetail.tsx — dynamische Plugin Detail-Tabs mit Permissions
- AppShell.tsx — PluginRegistry Provider eingebunden
- SettingsPlugins.tsx — Install-UI (ZIP Upload + URL Install)
- plugins.ts — useUploadPlugin() + useInstallPluginFromUrl() Hooks

Docs & Templates:
- docs/plugin-development-guide.md — komplette Entwickler-Doku
- templates/plugin-template/ — Boilerplate mit allen Manifest-Feldern

Tests:
- 34 Vitest-Tests (PluginRegistry, PluginLoader, PluginRouteRenderer,
  pluginStore) — alle bestanden
- TSC: keine neuen Errors (nur pre-existing Dms.tsx)

templates/plugin-template/routes.py

@@ -0,0 +1,48 @@
+"""
+API routes for the example plugin.
+
+Each route must be secured with require_permission.
+"""
+
+from fastapi import APIRouter, Depends
+
+from app.deps import get_current_user, require_permission
+
+router = APIRouter()
+
+
+@router.get(
+    "",
+    dependencies=[Depends(require_permission("example:read"))],
+)
+async def list_items(current_user: dict = Depends(get_current_user)):
+    """List all items."""
+    return {"items": [], "total": 0}
+
+
+@router.post(
+    "",
+    status_code=201,
+    dependencies=[Depends(require_permission("example:write"))],
+)
+async def create_item(current_user: dict = Depends(get_current_user)):
+    """Create a new item."""
+    return {"status": "created"}
+
+
+@router.get(
+    "/{item_id}",
+    dependencies=[Depends(require_permission("example:read"))],
+)
+async def get_item(item_id: str, current_user: dict = Depends(get_current_user)):
+    """Get a single item by ID."""
+    return {"id": item_id}
+
+
+@router.delete(
+    "/{item_id}",
+    dependencies=[Depends(require_permission("example:write"))],
+)
+async def delete_item(item_id: str, current_user: dict = Depends(get_current_user)):
+    """Delete an item by ID."""
+    return {"status": "deleted"}