feat: add per-tool execution approval gate and streamline tool settings

[yyg-max]

Summary

Add a permission gate that can require explicit user approval before a tool
runs, with a centralized approval bar that shows the exact command. Alongside
the feature, shrink the tool-config surface by removing the unfinished plugin
platform and the vestigial selectable/custom system tools, and merge the two
overlapping tool settings pages into one.

Changes

Permission gate

• Resolve an allow / ask / deny policy per tool — by explicit tool name,
  MCP server:<id>, or tool group:<id> — from settings.system.toolPolicies,
  enforced in beforeToolCall. Default stays allow, so no regression.
• Add a centralized approval bar above the composer: per-call allow once,
  allow for this chat (in-memory, per conversation), and deny, plus batch
  allow/deny when more than one tool is pending.
• Show the pending tool's command/arguments in the approval bar — full command,
  wrapped, height-capped with internal scroll for very long commands — and keep
  the transcript tool card collapsed while awaiting approval.
• Persist toolPolicies through the existing system_settings store; sync the
  pending marker + summary to the WebUI over the gateway event stream.

Remove plugin platform

• Delete the QuickJS plugin runtime, manifest/install/grants/config, plugin
  skills discovery, the Plugins Hub, and the AppSettings.plugins field.
• rquickjs is retained for provider usage queries.

Remove selectable/custom system tools (proto to UI)

• Reserve ChatRequest field 6 (selected_system_tools) in gateway.proto
  and regenerate Go/TS; drop it from the Go handler, the Rust event/settings
  layer, and the desktop turn pipeline.
• Delete the http_get_test demo tool and customSystemTools.

Streamline settings

• Fold the built-in tool approval controls into the System Tools page and remove
  the separate Tool Permissions page.
• Remove the dead ToolApprovalCard component.

Compatibility and upgrade

• buf breaking passes: field 6 is reserved (number + name), so the wire format
  stays compatible; new clients simply omit it and old payloads are ignored.
• toolPolicies defaults to empty (every tool allow), so existing setups see
  no behavior change until a user opts a tool into ask/deny.
• Requires a gateway + desktop restart after upgrade so the regenerated protobuf
  takes effect.

Test plan

• Set a tool (e.g. Bash) to ask in System Tools; confirm the approval
  bar appears with the command and the transcript card stays collapsed.
• allow once / deny / allow for this chat behave per scope; a new
  conversation asks again.
• Long/multi-line command shows fully in the bar (wrapped, scrolls) without
  pushing the buttons off.
• WebUI shows the same approval bar + command over the gateway bridge, and
  recovers after a page refresh.
• Settings shows a single System Tools page with per-tool policy; no Plugins
  or Tool Permissions entries remain.
• Gates: buf lint/breaking, go build/test, cargo check/test,
  both tsc, biome, mirror.