Setup wizard P2: per-plugin config schema + settings-first creds

- Plugin contract gains get_config_schema(); the plugins list API returns it.
  Employees plugin declares its directory-DB fields (host/name/user + password).
- employee_connection reads host/name/user settings-first (env fallback); the
  password stays env-only.
- Setup wizard Features step renders each enabled plugin's config: non-secret
  fields save to settings; secrets are never stored - the wizard emits .env
  lines to paste. Fixed the plugins-list data path (data.plugins).
- Settings PUT now upserts (creates the row on first write) so plugin-config
  keys can be saved without pre-seeding.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/employees/plugin.py

@@ -58,6 +58,21 @@ class EmployeesPlugin(BasePlugin):
         """No models - the directory is an external database."""
         return []
 
+    def get_config_schema(self) -> List[Dict]:
+        """Employee directory DB connection. Host/name/user are settings the
+        wizard can edit; the password stays in .env (emitted, not stored)."""
+        return [
+            {'key': 'employee_db_host', 'label': 'Employee DB host', 'type': 'text',
+             'secret': False, 'default': 'localhost'},
+            {'key': 'employee_db_name', 'label': 'Employee DB name', 'type': 'text',
+             'secret': False, 'default': 'wjf_employees'},
+            {'key': 'employee_db_user', 'label': 'Employee DB user', 'type': 'text',
+             'secret': False},
+            {'key': 'employee_db_password', 'label': 'Employee DB password', 'type': 'password',
+             'secret': True, 'envvar': 'EMPLOYEE_DB_PASSWORD',
+             'help': 'Stored in .env, not the database. The wizard shows the line to paste.'},
+        ]
+
     def init_app(self, app: Flask, db_instance) -> None:
         """Initialize plugin with Flask app."""
         logger.info(f"Employees plugin initialized (v{self.meta.version})")