Scaffold a plugin's frontend into the plugin, so it can be pruned

`flask plugin new` wrote views to frontend/src/views/<name>/ and a route file
to frontend/src/router/routes/<name>.js. Every one of the 16 bundled plugins
keeps its frontend in plugins/<name>/frontend/ instead, staged into
.plugins-staged by stage-frontend.mjs and aggregated into routes.gen.js.

It was not visibly broken, which is why it lasted: the router still globs
./routes/*.js during the Phase 4 dual-location transition, so a scaffolded
plugin's pages loaded. What a new plugin author silently lost was ADR-013 lean
builds. Pruning works off the staged tree, so a frontend in the core tree
cannot be excluded from a site build, and deleting the plugin strands its
views behind.

The templates for the correct layout already existed; only the output paths
were wrong. Also fixed the imports they carry: core imports now use the @
alias (@/api, @/components/...), which resolves both before and after staging,
where the previous ../../api was correct only in the old location. Sibling
views stay relative and travel with the route file.

frontend_dir is gone from scaffold_plugin. There is no second output tree to
point at, and a plugin developed in its own repo now gets the same frontend as
a bundled one rather than being skipped.

Proven end to end: scaffolded a throwaway plugin, confirmed it stages, builds
real chunks, and that SITE_PLUGINS=network prunes it, which is what the old
layout could not do.

shopdb/plugins/templates/frontend/routes.js.tmpl

@@ -1,35 +1,49 @@
 /**
  * ${Name} plugin routes.
  *
- * Auto-discovered by the router via import.meta.glob, so no registration
- * edit is needed. Every route carries meta.plugin '${name}' so the ADR-009
- * guard redirects to the dashboard when the ${name} backend plugin is
- * disabled. Form routes add requiresAuth so anonymous users cannot reach
- * create or edit.
+ * This file lives in the plugin, not in the core frontend tree.
+ * scripts/stage-frontend.mjs copies plugins/${name}/frontend/ into
+ * frontend/src/.plugins-staged/${name}/ and aggregates this default export
+ * into routes.gen.js, which the router spreads in - so no registration edit
+ * is needed, and pruning the plugin for a lean build removes its frontend
+ * with it (ADR-013).
+ *
+ * Every route carries meta.plugin '${name}' so the ADR-009 guard redirects to
+ * the dashboard when the ${name} backend plugin is disabled. Form routes add
+ * requiresAuth so anonymous users cannot reach create or edit.
+ *
+ * View imports are relative (./views/...) because they travel with this file.
+ * Anything from the CORE tree uses the @ alias (@/api, @/components/...),
+ * which resolves the same before and after staging.
  */
 export default [
   {
     path: '${name}',
     name: '${name}',
-    component: () => import('../../views/${name}/${Name}List.vue'),
+    component: () => import('./views/${Name}List.vue'),
     meta: { plugin: '${name}' }
   },
   {
     path: '${name}/new',
     name: '${name}-new',
-    component: () => import('../../views/${name}/${Name}Form.vue'),
+    component: () => import('./views/${Name}Form.vue'),
     meta: { requiresAuth: true, plugin: '${name}' }
   },
   {
     path: '${name}/:id',
     name: '${name}-detail',
-    component: () => import('../../views/${name}/${Name}Detail.vue'),
+    component: () => import('./views/${Name}Detail.vue'),
     meta: { plugin: '${name}' }
   },
   {
     path: '${name}/:id/edit',
     name: '${name}-edit',
-    component: () => import('../../views/${name}/${Name}Form.vue'),
+    component: () => import('./views/${Name}Form.vue'),
     meta: { requiresAuth: true, plugin: '${name}' }
   }
 ]
+
+// Full-screen routes that render OUTSIDE AppLayout (kiosk, print pages).
+// Declared even when empty so routes.gen.js can read `.toplevel` off the
+// module without Rollup warning about a missing export.
+export const toplevel = []