refactor(plugins): the plugin RPC kit moves out of the plugins domain into src/nest-rpc

Every domain's *.rpc.ts was written against rpc-kit, rpc-params, rpc-errors
and PluginGuards, and every domain module imported PluginGuardsModule, all
of it inside src/nest/plugins, while PluginsRuntimeModule imports those same
domains so their handlers exist at boot. That made the plugins domain part
of every cycle. The kit imports no domain but the protocol tables and
permissions/addons for the guards, so it moves to src/nest-rpc beside
src/nest-mcp, with its tests, its README and its extraction rule; the
runtime module keeps its domain imports, which the boot-time coverage check
of the wire surface needs in any subset app.

server/tests/unit/scripts/import-boundaries.test.ts

@@ -124,7 +124,7 @@ describe('import-boundaries.mjs', () => {
       'nest/b/b.helpers.ts': 'export const h = 1;\n',
       'nest/b/b.types.ts': 'export interface T { x: number }\n',
       'nest/common/row-id.ts': 'export const id = 1;\n',
-      'nest/plugins/host/rpc-kit/decorators.ts': 'export const Rpc = 1;\n',
+      'nest/audit/client-ip.ts': 'export const Rpc = 1;\n',
     };
     const ok = serverRoot({
       ...files,
@@ -132,7 +132,7 @@ describe('import-boundaries.mjs', () => {
         "import { B } from '../b/b.service';",
         "import type { T } from '../b/b.types';",
         "import { id } from '../common/row-id';",
-        "import { Rpc } from '../plugins/host/rpc-kit/decorators';",
+        "import { Rpc } from '../audit/client-ip';",
         'export const a: [unknown, T | null, number, number] = [B, null, id, Rpc];',
         '',
       ].join('\n'),