#2623: feat: WebUI dashboard plugin system — embed plugin pages inline

Problem

Hermes WebUI supports lifecycle-hook plugins in Settings → Plugins, but dashboard plugins (e.g. NIC Branch Sync, Session Review) that ship their own UI under ~/.hermes/plugins/<name>/dashboard/ have no way to be rendered within the WebUI. Users must navigate to plugin pages manually or use separate browser tabs.

Proposed Solution

Add a dashboard plugin discovery and rendering system:

1. Discovery — Scan ~/.hermes/plugins/<name>/dashboard/manifest.json at startup
2. Serving — Route plugin static assets (/plugins/, /dashboard-plugins/) with path-traversal protection
3. Rendering — Open plugin pages in an isolated iframe within the main content area, triggered by an "Open" button on plugin cards in Settings → Plugins
4. Isolation — Use iframes so plugin CSS/JS/modals do not affect the main WebUI

Plugin page serve order

1. dashboard/dist/index.html (full SPA build)
2. static/index.html (content page)
3. Auto-generated IIFE shell (fallback)

Tradeoffs

• Iframe same-origin: plugins are locally-installed, trust model similar to VS Code extensions. No untrusted plugin marketplace support.
• No build step: plugin pages are served as-is from the filesystem, preserving the no-bundler architecture.

Implementation

PR #2622 implements this feature.