Decouple core from plugins; wire widgets hook; drop dead search hook

Architectural pass from the skill review ("plugin is the product" boundary).

Core no longer imports plugin models at module load (was a hard import-time
dependency that broke core if the computers plugin was absent/disabled):
- collector.py, applications.py, reports.py: lazy + guarded imports of the
  computers plugin models. Endpoints that need install-tracking now return 503
  when the plugin is absent instead of failing at import.

Search honors runtime enable/disable:
- search.py: _require_enabled(name) raises ImportError for a disabled plugin,
  so each plugin-scoped block skips it (a disabled plugin's rows leave search).
- Replace hardcoded root/rootpassword employee-DB connection in _search_employees
  with the shared env-backed employee_connection helper.

Plugin hooks (integrating-plugin-hooks: every hook needs a consumer):
- get_dashboard_widgets: add the consumer GET /api/dashboard/widgets (5 plugins
  already implemented the hook; it had none). Skips disabled, isolates in prod.
- get_searchable_fields: REMOVED. Zero plugins implemented it and there was no
  consumer; global search is a core concern over the asset model. Contract
  reduction, __contract_version__ 0.3.0 -> 0.4.0.

Docs/contract: PLUGIN-HOOKS.md (widgets consumer note, searchable-fields removal,
0.4.0), PLUGIN-QUICKSTART.md, ADR-001 hook list. Tests: widgets endpoint
aggregate + disabled-skip; contract tests for the removed/added hooks.

151 tests pass, naming/style green, app boots all 6 plugins.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_plugin_contract.py

@@ -126,12 +126,15 @@ def test_plugin_get_navigation_items_is_iterable(plugin_instances, name):
     assert isinstance(items, list)
 
 
-@pytest.mark.parametrize('name', BUNDLED_PLUGINS)
-def test_plugin_get_searchable_fields_is_iterable(plugin_instances, name):
-    """get_searchable_fields returns a list (default empty)."""
-    plugin = plugin_instances[name]
-    fields = plugin.get_searchable_fields()
-    assert isinstance(fields, list)
+def test_baseplugin_has_no_searchable_fields_hook():
+    """get_searchable_fields was removed: global search is a core concern over
+    the asset model, and no plugin ever implemented the hook (contract 0.4.0)."""
+    assert not hasattr(BasePlugin, 'get_searchable_fields')
+
+
+def test_baseplugin_has_dashboard_widgets_hook():
+    """The dashboard widgets hook is on the contract surface and consumed."""
+    assert hasattr(BasePlugin, 'get_dashboard_widgets')
 
 
 def test_baseplugin_does_not_have_event_handlers_hook():