feat(plugins): hero widget slot + Koffi reference plugin

Widget plugins can now declare capabilities.widget.slot 'hero' to render as a
transparent, click-through overlay sitting on the boarding-pass bar's top edge
(migration 157 persists capabilities; manifest validation server+SDK, feed
exposes the slot, dashboard mounts hero frames above the pass). Sidebar stays
the default slot.

Replaces the trip-countdown example with Koffi, the TREK mascot: an animated
suitcase with a 14-state behavior engine driven by real trip data — walking,
waving, napping, trolley rolls, passport-stamp stickers, a split-flap luggage-
tag countdown under 7 days, and sunglasses while the trip runs. Validated by
the SDK suite like any author plugin; published as mauriceboe/trek-plugin-koffi
in the registry.

Migrations 156/157 follow the idempotent ALTER pattern (the reconciliation
test re-runs everything from v135, so duplicate-column must stay non-fatal).

plugin-sdk/examples/koffi/trek-plugin.json

@@ -0,0 +1,21 @@
+{
+  "id": "koffi",
+  "name": "Koffi",
+  "version": "1.0.0",
+  "apiVersion": 1,
+  "author": "TREK",
+  "description": "Koffi, the tiny suitcase mascot, lives on your boarding pass — strolling, rolling, collecting stickers, and getting more excited the closer your trip gets.",
+  "homepage": "https://github.com/mauriceboe/trek-plugin-koffi",
+  "license": "MIT",
+  "icon": "Luggage",
+  "type": "widget",
+  "trek": ">=3.2.0 <4.0.0",
+  "nativeModules": false,
+  "permissions": ["db:read:trips"],
+  "capabilities": {
+    "widget": { "title": "Koffi", "slot": "hero" }
+  },
+  "routes": [
+    { "method": "GET", "path": "/state", "auth": true }
+  ]
+}