feat(plugins): sandboxed page/widget frames + trekBridge (M3)

Plugins can now render UI. Page plugins appear as a nav entry and open a
full-page sandboxed iframe; the frame talks to TREK only over the postMessage
bridge.

- Server serves plugin client assets at /plugin-frame/:id/* with a strict path
  guard and a locked-down, per-plugin CSP (default-src none; connect-src limited
  to declared outbound hosts; sandbox WITHOUT allow-same-origin -> opaque origin,
  so the frame can't read the session cookie or the parent DOM). Global CSP
  frameSrc relaxed from 'none' to 'self' for exactly these frames.
- GET /api/plugins feed lists active plugins for the client.
- Client: pluginStore + PluginFrame (the trekBridge host) authenticates every
  inbound message by SENDER WINDOW IDENTITY (event.source), not by a claimed id
  or origin; pushes context (theme/locale/tripId/userId), validates navigation,
  renders notifications as text, resizes widgets, and proxies trek:invoke to the
  plugin's own routes host-side (session cookie stays with the host).
- Page route /plugins/:id + Navbar nav injection for page plugins.

Dashboard widget slot and the trek:request core-data bridge are deferred to a
later slice.

server/src/nest/plugins/plugin-frame.controller.ts

@@ -0,0 +1,85 @@
+import { Controller, Get, Param, Req, Res } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import fs from 'node:fs';
+import path from 'node:path';
+import { pluginsEnabled } from './kill-switch';
+import { PluginRuntimeService } from './plugin-runtime.service';
+import { pluginCodeDir } from './paths';
+
+/**
+ * Serves a page/widget plugin's static client from /plugin-frame/:id/* (#plugins,
+ * M3). The document is embedded in a sandbox WITHOUT allow-same-origin, so it
+ * runs at an OPAQUE origin: it cannot read the trek_session cookie, cannot reach
+ * the parent DOM, and its only channel to TREK is the postMessage bridge.
+ *
+ * Each response gets a locked-down, per-plugin CSP (default-src none; own scripts
+ * only; connect-src limited to declared outbound hosts) and a strict path guard
+ * so a plugin can only serve files under its own client/ directory.
+ */
+const MIME: Record<string, string> = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+  '.woff2': 'font/woff2',
+  '.ico': 'image/x-icon',
+};
+
+@Controller('plugin-frame/:pluginId')
+export class PluginFrameController {
+  constructor(private readonly runtime: PluginRuntimeService) {}
+
+  @Get('*path')
+  serve(@Param('pluginId') pluginId: string, @Req() req: Request, @Res() res: Response): void {
+    if (!pluginsEnabled() || !this.runtime.isActive(pluginId)) {
+      res.status(404).send('Plugin not available');
+      return;
+    }
+
+    const rest = (req.params as Record<string, unknown>).path ?? (req.params as Record<string, unknown>)[0] ?? '';
+    const rel = (Array.isArray(rest) ? rest.join('/') : String(rest)).replace(/^\/+/, '') || 'index.html';
+
+    const clientDir = path.join(pluginCodeDir(pluginId), 'client');
+    const resolved = path.resolve(clientDir, rel);
+    // Containment: never escape the plugin's own client/ dir.
+    if (!resolved.startsWith(path.resolve(clientDir) + path.sep) && resolved !== path.resolve(clientDir)) {
+      res.status(403).send('Forbidden');
+      return;
+    }
+    if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) {
+      res.status(404).send('Not found');
+      return;
+    }
+
+    const ext = path.extname(resolved).toLowerCase();
+    res.setHeader('Content-Type', MIME[ext] ?? 'application/octet-stream');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Content-Security-Policy', this.frameCsp(pluginId));
+    res.sendFile(resolved);
+  }
+
+  /** Per-plugin, locked-down CSP for the sandboxed frame document. */
+  private frameCsp(pluginId: string): string {
+    const outbound = this.runtime.outboundHostsOf(pluginId);
+    const connect = ["'self'", ...outbound.map((h) => (h.includes('://') ? h : `https://${h}`))].join(' ');
+    return [
+      "default-src 'none'",
+      "script-src 'self'",
+      "style-src 'self' 'unsafe-inline'",
+      "img-src 'self' data: blob:",
+      "font-src 'self' data:",
+      `connect-src ${connect}`,
+      "frame-ancestors 'self'",
+      "base-uri 'none'",
+      "form-action 'self'",
+      'sandbox allow-scripts allow-forms allow-popups',
+    ].join('; ');
+  }
+}