[BUG] — `plugin` list/snapshot: `plugin_jar` BLOB in list + unindexed `selector.plugin_id` join + correlated subqueries

- severity: Medium-High; files: `mappers/plugin-sqlmap.xml:86-125` (`selectByQuery`/`selectAll`) and `:160-185` (`activePluginSnapshot`); `Base_Column_List:35-46` includes `plugin_jar`
- description: `activePluginSnapshot` does `LEFT JOIN selector s ON p.id = s.plugin_id` but `selector` has no index on `plugin_id` (only PK) → full scan of `selector` per plugin row. `resource.parent_id`, `permission.object_id`, `permission.resource_id`, `user_role.user_id` all unindexed → nested correlated subqueries do full scans. `selectByQuery`/`selectAll` fetch `plugin_jar` BLOB per row and use leading-wildcard `LIKE` on `name`/`role`.
- impact: Snapshot/dashboard query cost is O(plugins × selectors) plus multiple full scans; BLOB transfer bloats list responses.
- suggested_fix: Add `index on selector(plugin_id)`; add indexes on `permission(object_id)`, `permission(resource_id)`, `resource(parent_id)`, `user_role(user_id)`; drop `plugin_jar` from `Base_Column_List` for list paths.
- confidence: High

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with mappers/plugin-sqlmap.xml ranges 86-125 and 160-185, then inspect the schema definitions for selector, permission, resource, and user_role. Verify the list paths no longer fetch plugin_jar, add the proposed indexes, and compare the snapshot and list query plans to confirm the full scans and BLOB transfer are addressed.

Written by the indexing model from the issue text.