refactor: manifest imports

[MarioCadenas]

• plugin manifests are now imported directly from manifest.json in plugins (analytics, genie, lakebase, server), and old runtime manifest.ts wrappers were removed.
• Security hardening for CLI: plugin list, plugin sync, and plugin validate are now JSON-first by default (no JS manifest execution unless explicitly enabled with --allow-js-manifest), with warning messaging when JS opt-in is used.
• New shared manifest resolver: added manifest-resolve utilities to centralize manifest discovery/loading and support optional JS manifest loading behind explicit opt-in.
• Plugin CLI improvements: recursive plugin discovery expanded, better manifest resolution across commands, clearer error messages, and updated behavior for add-resource (still edits manifest.json only).
• Scaffolding updates: plugin scaffold no longer generates manifest.ts; generated plugin code imports manifest.json directly.
• Build/package updates: upgraded tsdown and adjusted build configs (including output extension/copy behavior), plus package metadata improvements (license, include LICENSE in files).
• Tests/docs: expanded test coverage around manifest resolution and listing behavior, and updated plugin management docs to reflect secure defaults and JS-manifest opt-in.