Employees + USB default-disabled with an enable-time provisioning note

Both plugins provision extra tables, so they now install disabled and explain
themselves before a site opts in.

- Plugin contract gains get_provisioning_note() -> {tables, note, docs}.
  Employees and USB implement it (what tables get created in shopdb, how they
  are referenced, link to the schema README; USB references the captured
  DLP/reminder plans).
- Manifest default_enabled=false for employees + usb; the plugins list API
  returns provisioning_note + default_enabled; install now registers a plugin
  disabled when default_enabled is false.
- Setup wizard Features step renders the provisioning note the moment a plugin
  with one is enabled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/usb/manifest.json

@@ -1,9 +1,10 @@
 {
-    "name": "usb",
-    "version": "1.0.0",
-    "description": "USB device checkout management",
-    "author": "ShopDB Team",
-    "dependencies": [],
-    "core_version": ">=0.1.0,<1.0.0",
-    "api_prefix": "/api/usb"
-}
+  "name": "usb",
+  "version": "1.0.0",
+  "description": "USB device checkout management",
+  "author": "ShopDB Team",
+  "dependencies": [],
+  "core_version": ">=0.1.0,<1.0.0",
+  "api_prefix": "/api/usb",
+  "default_enabled": false
+}