feat(plugin-sdk): dev server, preflight, auto-PR submit, signing, wizard

Round out the author experience so the loop is create -> dev -> release/submit
without hand-work or a round-trip through registry review.

- `dev`: run a plugin locally with a real request loop and hot reload — no full
  TREK. Injects a ctx that enforces the manifest's granted permissions (an
  ungranted call throws, so you catch a missing grant), backs db:own with a real
  SQLite file (node:sqlite), serves routes under /api and page/widget UI at /ui,
  and reloads on save. Dependency-free (node:http + built-ins).
- `preflight`: run the registry CI checks locally over the network (tag->commit,
  manifest parity, artifact sha256/size, native scan, README quality gate) so a
  green run predicts a green CI.
- `submit`: fork TREK-Plugins, branch off current main, write/merge the entry,
  push, and open the PR — the last manual publishing step, automated.
- `keygen`/`sign` + `--sign` on entry/release/submit: dependency-free Ed25519
  author signatures over the artifact bytes, verified 1:1 against the server's
  TOFU check. Fills authorPublicKey + signature and guards against a key change.
- `create` gains an interactive wizard (id/type/author/permissions) and flags.
- README + Development/Publishing/Permissions wikis document the new flow.

24 tests pass (sign round-trips through a server-shaped verifier; zip reader;
scaffold options; entry signing + key-change guard).

wiki/Plugin-Development.md

@@ -9,10 +9,14 @@ child process** and reaches it only over RPC; the browser part runs in a
 ## Scaffold
 
 ```bash
-npx trek-plugin-sdk create my-plugin --type integration|page|widget
+npx trek-plugin-sdk create                # interactive wizard
+npx trek-plugin-sdk create my-plugin --type integration|page|widget   # or direct
 cd my-plugin
 ```
 
+The wizard (run `create` with no name) asks for the id, type, author and
+permissions; the direct form takes them as flags.
+
 This emits:
 
 ```
@@ -23,6 +27,25 @@ my-plugin/
   README.md             # fill this in — the registry requires a screenshot
 ```
 
+## Run it locally with hot reload
+
+```bash
+npx trek-plugin-sdk dev        # http://localhost:4317
+```
+
+`dev` loads your `server/index.js` through the same `definePlugin` contract the
+host uses and gives you a **real request loop without a full TREK**: a dashboard
+listing your routes, the routes served under `/api/<path>`, your page/widget UI
+at `/ui`, and a reload on every save. The injected `ctx` **enforces exactly the
+permissions your manifest grants** — an ungranted call throws `PERMISSION_DENIED`,
+so you catch a missing grant here rather than after install. `db:own` is backed
+by a real SQLite file (`.trek-dev/db.sqlite`) when the runtime has `node:sqlite`.
+
+- Hit a route as an unauthenticated request with `?_anon=1` (an `auth: true`
+  route then returns 401, mirroring the host).
+- Feed `ctx.trips` / `ctx.users` by dropping a `dev-fixtures.json` next to the
+  manifest: `{ "trips": { "1": { "members": [1], "data": { … } } }, "users": {} }`.
+
 ## The three plugin types
 
 - **integration** — background logic (jobs, routes) with no UI of its own. Photo-