Ship plugin framework shore-up: frontend scaffold, sister-site adoption kit

- flask plugin new now scaffolds the frontend too: List/Detail/Form
  views on the global styles, a gated route module (ADR-009), and an
  api-client snippet emitted into the plugin dir. Views are written
  before the route file so a partially generated plugin cannot 500 the
  dev server.
- docs/PLUGIN-EXTERNAL-REPO.md + scripts/test-external-plugin.sh: how a
  sister site develops a plugin in its own repo and runs the framework
  contract tests in CI against a pinned framework ref (script verified
  to fail on a broken core_version pin).
- docs/CONTRACT-STABILITY.md: settled vs churning contract surface and
  the provisional 1.0 criteria.
- CLAUDE.md active-state refresh (contract 0.6.0, 11 plugins, 340
  tests, measuringtools done).

Known limitation documented: Path.rglob does not descend symlinks, so
the import-surface contract test skips symlinked external plugins.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/plugins/templates/frontend/frontend-api-snippet.js.tmpl

@@ -0,0 +1,35 @@
+/*
+ * ${Name} API client snippet.
+ *
+ * Paste this ${name}Api block into frontend/src/api/index.js (next to the
+ * other per-resource blocks). Then, in the generated ${Name}List, ${Name}Detail,
+ * and ${Name}Form views, delete the local ${name}Api const and import the shared
+ * one instead:
+ *
+ *   import { ${name}Api } from '../../api'
+ *
+ * The scaffolded views ship with an identical inline client so they build and
+ * run before you touch the shared api module. This file is NOT auto-merged into
+ * api/index.js on purpose; that module is hand-maintained and shared.
+ *
+ * The create/update/delete calls assume matching POST/PUT/DELETE routes exist
+ * on the backend. The scaffolded api/routes.py only ships list and get; add the
+ * write endpoints when you wire up the form.
+ */
+export const ${name}Api = {
+  list(params = {}) {
+    return api.get('/${name}', { params })
+  },
+  get(itemId) {
+    return api.get(`/${name}/${itemId}`)
+  },
+  create(data) {
+    return api.post('/${name}', data)
+  },
+  update(itemId, data) {
+    return api.put(`/${name}/${itemId}`, data)
+  },
+  remove(itemId) {
+    return api.delete(`/${name}/${itemId}`)
+  }
+}