Decouple core from plugins; wire widgets hook; drop dead search hook

Architectural pass from the skill review ("plugin is the product" boundary).

Core no longer imports plugin models at module load (was a hard import-time
dependency that broke core if the computers plugin was absent/disabled):
- collector.py, applications.py, reports.py: lazy + guarded imports of the
  computers plugin models. Endpoints that need install-tracking now return 503
  when the plugin is absent instead of failing at import.

Search honors runtime enable/disable:
- search.py: _require_enabled(name) raises ImportError for a disabled plugin,
  so each plugin-scoped block skips it (a disabled plugin's rows leave search).
- Replace hardcoded root/rootpassword employee-DB connection in _search_employees
  with the shared env-backed employee_connection helper.

Plugin hooks (integrating-plugin-hooks: every hook needs a consumer):
- get_dashboard_widgets: add the consumer GET /api/dashboard/widgets (5 plugins
  already implemented the hook; it had none). Skips disabled, isolates in prod.
- get_searchable_fields: REMOVED. Zero plugins implemented it and there was no
  consumer; global search is a core concern over the asset model. Contract
  reduction, __contract_version__ 0.3.0 -> 0.4.0.

Docs/contract: PLUGIN-HOOKS.md (widgets consumer note, searchable-fields removal,
0.4.0), PLUGIN-QUICKSTART.md, ADR-001 hook list. Tests: widgets endpoint
aggregate + disabled-skip; contract tests for the removed/added hooks.

151 tests pass, naming/style green, app boots all 6 plugins.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_core/test_dashboard_widgets.py

@@ -0,0 +1,38 @@
+"""Tests for the dashboard-widgets hook consumer (/api/dashboard/widgets).
+
+Pins the wiring added for the BasePlugin.get_dashboard_widgets hook: the
+endpoint aggregates enabled plugins' widgets and skips disabled ones.
+
+Plugin enabled-state is monkeypatched (not persisted) so these tests do not
+mutate the shared instance/plugins.json registry file.
+"""
+
+
+def _widget_plugins(client, headers):
+    response = client.get('/api/dashboard/widgets', headers=headers)
+    assert response.status_code == 200, response.get_json()
+    widgets = response.get_json()['data']
+    assert isinstance(widgets, list)
+    return widgets, {w.get('plugin') for w in widgets}
+
+
+def test_widgets_endpoint_aggregates_enabled_plugins(app, client, auth_headers,
+                                                     monkeypatch):
+    """An enabled plugin that implements the hook contributes a widget."""
+    pm = app.extensions['plugin_manager']
+    monkeypatch.setattr(pm.registry, 'is_enabled', lambda name: True)
+
+    widgets, plugins = _widget_plugins(client, auth_headers)
+    assert 'computers' in plugins  # computers implements get_dashboard_widgets
+    positions = [w.get('position', 99) for w in widgets]
+    assert positions == sorted(positions)
+
+
+def test_widgets_endpoint_skips_disabled_plugin(app, client, auth_headers,
+                                                monkeypatch):
+    """A disabled plugin's widgets drop out of the aggregate."""
+    pm = app.extensions['plugin_manager']
+    monkeypatch.setattr(pm.registry, 'is_enabled', lambda name: name != 'computers')
+
+    _, plugins = _widget_plugins(client, auth_headers)
+    assert 'computers' not in plugins

tests/test_plugin_contract.py

@@ -126,12 +126,15 @@ def test_plugin_get_navigation_items_is_iterable(plugin_instances, name):
     assert isinstance(items, list)
 
 
-@pytest.mark.parametrize('name', BUNDLED_PLUGINS)
-def test_plugin_get_searchable_fields_is_iterable(plugin_instances, name):
-    """get_searchable_fields returns a list (default empty)."""
-    plugin = plugin_instances[name]
-    fields = plugin.get_searchable_fields()
-    assert isinstance(fields, list)
+def test_baseplugin_has_no_searchable_fields_hook():
+    """get_searchable_fields was removed: global search is a core concern over
+    the asset model, and no plugin ever implemented the hook (contract 0.4.0)."""
+    assert not hasattr(BasePlugin, 'get_searchable_fields')
+
+
+def test_baseplugin_has_dashboard_widgets_hook():
+    """The dashboard widgets hook is on the contract surface and consumed."""
+    assert hasattr(BasePlugin, 'get_dashboard_widgets')
 
 
 def test_baseplugin_does_not_have_event_handlers_hook():