Plugin capability-permissions prompt on first load

Split out from the plugin-system foundation epic #16 (Phase 4).

A plugin should surface the host capabilities it needs (network / tcp, filesystem, secure-storage, tabs, cross-plugin data, …) and the user should approve them on first load — a single capability-permissions prompt, distinct from the per-action consent already in place.

## Context
- Network/tcp already has a consent + policy layer (domain allowlist, SSRF guard) from the URL Source work (#14), and cross-plugin *data* consent is tracked separately (#116).
- What's missing: a general, manifest-declared capability set shown as an approve/deny prompt when a plugin is first loaded or installed.

## Scope
- Declare required capabilities in `plugin.toml`.
- Host prompt on first load listing them; persist the grant.
- Enforce at the host boundary (deny ungranted capability calls).

**Releasable:** installing/first-loading a plugin shows a capability prompt; denied capabilities are blocked.