Ship plugin framework shore-up: frontend scaffold, sister-site adoption kit

- flask plugin new now scaffolds the frontend too: List/Detail/Form
  views on the global styles, a gated route module (ADR-009), and an
  api-client snippet emitted into the plugin dir. Views are written
  before the route file so a partially generated plugin cannot 500 the
  dev server.
- docs/PLUGIN-EXTERNAL-REPO.md + scripts/test-external-plugin.sh: how a
  sister site develops a plugin in its own repo and runs the framework
  contract tests in CI against a pinned framework ref (script verified
  to fail on a broken core_version pin).
- docs/CONTRACT-STABILITY.md: settled vs churning contract surface and
  the provisional 1.0 criteria.
- CLAUDE.md active-state refresh (contract 0.6.0, 11 plugins, 340
  tests, measuringtools done).

Known limitation documented: Path.rglob does not descend symlinks, so
the import-surface contract test skips symlinked external plugins.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/plugins/templates/frontend/routes.js.tmpl

@@ -0,0 +1,35 @@
+/**
+ * ${Name} plugin routes.
+ *
+ * Auto-discovered by the router via import.meta.glob, so no registration
+ * edit is needed. Every route carries meta.plugin '${name}' so the ADR-009
+ * guard redirects to the dashboard when the ${name} backend plugin is
+ * disabled. Form routes add requiresAuth so anonymous users cannot reach
+ * create or edit.
+ */
+export default [
+  {
+    path: '${name}',
+    name: '${name}',
+    component: () => import('../../views/${name}/${Name}List.vue'),
+    meta: { plugin: '${name}' }
+  },
+  {
+    path: '${name}/new',
+    name: '${name}-new',
+    component: () => import('../../views/${name}/${Name}Form.vue'),
+    meta: { requiresAuth: true, plugin: '${name}' }
+  },
+  {
+    path: '${name}/:id',
+    name: '${name}-detail',
+    component: () => import('../../views/${name}/${Name}Detail.vue'),
+    meta: { plugin: '${name}' }
+  },
+  {
+    path: '${name}/:id/edit',
+    name: '${name}-edit',
+    component: () => import('../../views/${name}/${Name}Form.vue'),
+    meta: { requiresAuth: true, plugin: '${name}' }
+  }
+]