refactor(plugins): the plugin RPC kit moves out of the plugins domain into src/nest-rpc

Every domain's *.rpc.ts was written against rpc-kit, rpc-params, rpc-errors
and PluginGuards, and every domain module imported PluginGuardsModule, all
of it inside src/nest/plugins, while PluginsRuntimeModule imports those same
domains so their handlers exist at boot. That made the plugins domain part
of every cycle. The kit imports no domain but the protocol tables and
permissions/addons for the guards, so it moves to src/nest-rpc beside
src/nest-mcp, with its tests, its README and its extraction rule; the
runtime module keeps its domain imports, which the boot-time coverage check
of the wire surface needs in any subset app.

server/docs/nest-migration-history.md

@@ -64,7 +64,9 @@ remains as the platform underneath `@nestjs/platform-express`.
   dispatches, audits and maps errors. `PluginHostDepsFactory` — the 26-argument
   wiring sheet named throughout the log below — is now
   `PluginRpcHostFactory` and injects two things. See
-  `plugins/host/rpc-kit/README.md`.
+  `src/nest-rpc/rpc-kit/README.md` (the kit, `rpc-params`, `rpc-errors` and
+  `PluginGuards` moved to `src/nest-rpc/`, a kernel layer beside `src/nest-mcp/`,
+  so a domain's `*.rpc.ts` no longer depends on the plugins domain).
 - **Plugin module split (complete):** `PluginsModule` was 21 controllers, 24 domain
   imports and 10 providers in one class, so `AdminModule` importing it for one
   cascade-disable call inherited the whole graph. It is now `PluginsRuntimeModule`