Decouple core from plugins; wire widgets hook; drop dead search hook

Architectural pass from the skill review ("plugin is the product" boundary).

Core no longer imports plugin models at module load (was a hard import-time
dependency that broke core if the computers plugin was absent/disabled):
- collector.py, applications.py, reports.py: lazy + guarded imports of the
  computers plugin models. Endpoints that need install-tracking now return 503
  when the plugin is absent instead of failing at import.

Search honors runtime enable/disable:
- search.py: _require_enabled(name) raises ImportError for a disabled plugin,
  so each plugin-scoped block skips it (a disabled plugin's rows leave search).
- Replace hardcoded root/rootpassword employee-DB connection in _search_employees
  with the shared env-backed employee_connection helper.

Plugin hooks (integrating-plugin-hooks: every hook needs a consumer):
- get_dashboard_widgets: add the consumer GET /api/dashboard/widgets (5 plugins
  already implemented the hook; it had none). Skips disabled, isolates in prod.
- get_searchable_fields: REMOVED. Zero plugins implemented it and there was no
  consumer; global search is a core concern over the asset model. Contract
  reduction, __contract_version__ 0.3.0 -> 0.4.0.

Docs/contract: PLUGIN-HOOKS.md (widgets consumer note, searchable-fields removal,
0.4.0), PLUGIN-QUICKSTART.md, ADR-001 hook list. Tests: widgets endpoint
aggregate + disabled-skip; contract tests for the removed/added hooks.

151 tests pass, naming/style green, app boots all 6 plugins.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shopdb/core/api/dashboard.py

@@ -152,6 +152,37 @@ def get_navigation():
     return success_response(all_items)
 
 
+@dashboard_bp.route('/widgets', methods=['GET'])
+@jwt_required(optional=True)
+def get_widgets():
+    """Aggregate dashboard widget definitions from all enabled plugins.
+
+    Consumer for the BasePlugin.get_dashboard_widgets hook. Skips disabled
+    plugins, isolates a broken plugin in prod (re-raises in dev/test), and
+    returns the merged list sorted by position.
+    """
+    pm = current_app.extensions.get('plugin_manager')
+    if not pm:
+        return success_response([])
+
+    widgets = []
+    for name, plugin in pm.get_all_plugins().items():
+        if not pm.registry.is_enabled(name):
+            continue
+        try:
+            for widget in plugin.get_dashboard_widgets() or []:
+                widget['plugin'] = name
+                widgets.append(widget)
+        except Exception:
+            if current_app.config.get('DEBUG') or current_app.config.get('TESTING'):
+                raise
+            current_app.logger.exception(
+                'Plugin %s get_dashboard_widgets failed', name)
+
+    widgets.sort(key=lambda w: w.get('position', 99))
+    return success_response(widgets)
+
+
 @dashboard_bp.route('/health', methods=['GET'])
 def health_check():
     """Health check endpoint (no auth required)."""