feat(plugins): add modular capabilities, secure settings, and canvas APIs

[Alitryel]

Summary

• add OS-backed encrypted plugin secrets with permission checks, quotas, change events, and uninstall cleanup
• let plugins contribute a dedicated settings entry to the Extensions menu
• list installed plugin HOME widgets beside built-in widgets in Appearance → HOME composition
• let plugin canvases declare minimum dimensions and open another plugin canvas beside the current one
• add storage change events for coordination between multiple plugin canvases
• add optional manifest modules with install-time checkboxes, exact byte counts, SHA-256 verification, and atomic reconfiguration
• download and activate only the selected module files, contributions, and permissions
• apply optional-module permissions consistently to SDK authorization and plugin resource CSP
• preserve v1.1.0 GitHub retry/backoff for manifest and module downloads and reject redirects outside pinned GitHub hosts
• document the plugin platform additions in English, Russian, and Chinese

CanvasTTY Music examples

• settingsContribution exposes the full Music Library from the Extensions menu
• canvas.open opens the library beside the compact player, while minSize keeps the workspace usable
• secure secrets keep the Yandex Music token out of plugin storage and repository files
• optional modules let users install only the sources and pets they need
• storage events let the library send a selected local or Yandex track to the compact player immediately
• module-derived network permission enables Yandex requests in both the SDK and the plugin CSP only when that module is active

Security and compatibility

• rebased cleanly onto CanvasTTY v1.1.0; existing manifests and the upstream HOME plugin-widget flow remain valid
• existing manifests remain valid and use the platform defaults
• module files are accepted only when both their declared size and SHA-256 digest match
• failed module changes roll back without replacing the working installation
• secrets require Electron safeStorage and are never returned through ordinary plugin storage

Verification

• npm.cmd test: 218 tests, 211 passed, 7 platform-specific skips
• npm.cmd run build: typecheck and production build passed

pm.cmd run audit:secrets: passed

• Electron/CDP smoke: Appearance exposed Music beside built-in HOME widgets; trusted click changed Add to Remove and mounted the plugin iframe in a home-widget slot
• independent Claude review: no blockers after retry and redirect hardening