dashboard: render plugin-declared cards, starting with enforcement failures

The frontend now calls /api/dashboard/widgets. It never had, which is why five
plugins have been declaring widgets into a void for months, pointing at
components nobody ever wrote.

Core owns three generic renderers - exceptions, metric, list - and a plugin
declares data, a shape and a link template. The mapping logic lives in a plain
module beside the component, the same split as pluginAssetPanels.js, so it is
unit tested without mounting anything: 16 tests covering row mapping, empty
handling, ordering and gating.

The behaviours worth naming, because each is a decision rather than an
implementation detail:

Cards fetch INDEPENDENTLY and a failure becomes null. One hung endpoint - a
Zabbix call, a plugin mid-upgrade - cannot blank the board. A card whose fetch
failed HIDES rather than drawing empty, because "nothing wrong" and "I could
not tell" must not look the same.

Empty cards disappear by default. A card reporting nothing every day teaches
people to stop reading the page, which is precisely how a fleet log reached
3,234 lines with 17 that mattered. A card opts into a one-line presence only
when its absence is itself news.

Severity outranks position, so an info card can never sit above a failure.

Permission filtering happens BEFORE fetching: no point firing a request that
would only 403, and the dashboard must not become a way around RBAC.

An unknown render mode is skipped, so a plugin built against a newer core
degrades instead of leaving a hole.

A row whose link substitution is missing keeps the row and drops the link -
a PC shopdb does not know still reports its failure, and that is the bay most
likely to be misconfigured.

Cards sit ABOVE the totals: what needs a person first, context second. The
existing stat cards are untouched for now.

frontend/src/views/Dashboard.vue

@@ -7,6 +7,12 @@
     <div v-if="loading" class="loading">Loading...</div>
 
     <template v-else>
+      <!-- What needs a person, before the totals that are true every day.
+           Cards are declared by plugins (get_dashboard_widgets) and rendered
+           generically; an empty or failed card hides itself. See
+           docs/proposals/dashboard-live-fleet.md. -->
+      <DashboardCards />
+
       <!-- Main Stats -->
       <div class="dashboard-grid">
         <div class="stat-card">
@@ -92,6 +98,7 @@
 </template>
 
 <script setup>
+import DashboardCards from '@/components/DashboardCards.vue'
 import { ref, onMounted } from 'vue'
 import { dashboardApi, assetsApi, printersApi } from '../api'