Employees + USB default-disabled with an enable-time provisioning note

Both plugins provision extra tables, so they now install disabled and explain
themselves before a site opts in.

- Plugin contract gains get_provisioning_note() -> {tables, note, docs}.
  Employees and USB implement it (what tables get created in shopdb, how they
  are referenced, link to the schema README; USB references the captured
  DLP/reminder plans).
- Manifest default_enabled=false for employees + usb; the plugins list API
  returns provisioning_note + default_enabled; install now registers a plugin
  disabled when default_enabled is false.
- Setup wizard Features step renders the provisioning note the moment a plugin
  with one is enabled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

shopdb/plugins/__init__.py

@@ -147,6 +147,11 @@ class PluginManager:
                         config_schema = temp.get_config_schema()
                     except Exception:
                         config_schema = []
+                    try:
+                        provisioning_note = temp.get_provisioning_note()
+                    except Exception:
+                        provisioning_note = None
+                    manifest = self.loader.load_manifest(name)
                     available.append({
                         'name': meta.name,
                         'version': meta.version,
@@ -157,6 +162,8 @@ class PluginManager:
                         'enabled': state.enabled if state else False,
                         'installedat': state.installed_at if state else None,
                         'config_schema': config_schema,
+                        'provisioning_note': provisioning_note,
+                        'default_enabled': manifest.get('default_enabled', True),
                     })
                 except Exception as e:
                     logger.warning(f"Error inspecting plugin {name}: {e}")
@@ -203,7 +210,10 @@ class PluginManager:
                 return False
 
         # Register plugin
-        self.registry.register(name, manifest_version)
+        # Plugins that provision extra tables install disabled until a site
+        # opts in (manifest default_enabled=false).
+        self.registry.register(name, manifest_version,
+                               enabled=manifest.get('default_enabled', True))
 
         # Load the plugin
         plugin = self.loader.load_plugin(name, self._app, self._db)