Add the get_permissions plugin hook (contract 0.10.0)

Plugins declare their own RBAC permissions instead of core accumulating
them: 36 permissions moved out of the core catalog into the 9 owning
plugins (core keeps the 19 its own blueprints enforce). The catalog is
resolved dynamically (core + enabled plugins) and feeds the roles grid,
the token scope picker and ceiling, and flask seed permissions;
installing or enabling a plugin seeds its permissions automatically. A
disabled plugin drops out of the assignable catalog while existing role
links keep working. New plugins - bundled or external - now bring their
permissions with zero core edits.

781 tests pass; live-verified with a machines.edit-scoped token.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -12,6 +12,23 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- Plugin `get_permissions` hook (contract 0.10.0) so a plugin declares the RBAC
+  permissions its own routes enforce, instead of core accumulating every
+  plugin's permissions in `Permission.PERMISSIONS` (plugin-is-the-product). The
+  core catalog (`Permission.CORE_PERMISSIONS`) now holds only genuinely core
+  sets (assets, applications, reports, settings, users, audit, apitokens,
+  collector); the 36 permissions for machines, computers, printers, network,
+  knowledgebase, notifications, usb, warranty, and measuringtools moved into
+  each owning plugin's hook. New core helper `full_permission_catalog()` merges
+  core plus every ENABLED plugin's permissions and backs all three consumers:
+  `flask seed permissions`, the role grid (`GET /api/users/permissions`), and
+  API-token scope validation (`ApiToken.unknown_scope_names`). Plugin install
+  and enable seed the plugin's own permissions idempotently. A disabled plugin
+  drops out of the catalog (no new scope grants or role assignments), but its
+  existing `Permission` rows and role links persist so current roles keep
+  working. Docs: `docs/PLUGIN-HOOKS.md` new section, `docs/PLUGIN-GUIDE.md`
+  permissions walkthrough rewritten to the hook, `docs/PLUGIN-QUICKSTART.md`
+  hooks table row.
 - Personal API tokens (PATs) so scripts and integrations authenticate without
   the hourly-expiring login JWT (immediate consumer: long legacy-import runs
   that die when the JWT expires mid-run). New core `apitokens` table + migration