feat: implement sprint event handling and real-time updates

[pikann]

Summary

Moves sprints from interval polling to socket-driven real-time updates, and adds the shared plugin api/ui/meta props scaffolding that plugin view/nav components expect.

Sprint real-time updates

• Added sprint.created / sprint.updated / sprint.deleted / sprint.completed topics and publish them from sprint_service.go on every mutation (best-effort — publish failures never block the HTTP response).
• Added a sprints namespace to the realtime service (permissions.ts / server.ts / subscriber.ts), gated on the sprints.read permission, mirroring the existing tasks / docs / workflows namespaces.
• useProjectRealtime now invalidates ["projects", projectId, "sprints"] on sprint.* events.
• Removed the sidebar's refetchInterval: 30_000 on the sprints query now that it updates live.

Plugin base props (api / ui / meta)

• Added usePluginBaseProps (plugin-props.ts), which builds the BaseExtensionProps every plugin extension-point component expects: an api client, ui (toast/confirm stubs + a real navigate), and meta (plugin id/name/version).
• Added createPluginApiClient (plugin-client.ts), a duck-typed host implementation of the plugin SDK's PluginApiClient (fetch-based, session-cookie auth) covering listTasks/getTask/getProject/listMembers and generic pluginGet/pluginPost/pluginPatch/pluginDelete.
• Wired these props into the plugin view extension point in InteractionLayout, and into both the admin and project plugin nav routes (previously those routes passed no/partial props to mounted plugin components).
• ExtensionPointRegistration gained an optional Label field for host-facing display names (falls back to Component).

Plugin runtime: db_query2

• Added a db_query2 WASM export in runtime.go that reports query execution errors back to the plugin. The existing db_query has no error channel, so a failing query (e.g. bad column reference) silently looks like a zero-row success — added as a new export rather than changing db_query in place, since widening its signature would break already-compiled plugin binaries that still import the 6-arg form.

Misc

• useProjectPermissions now guards its query with enabled: !!projectId.

[pullfrog]

Important

This PR lands the sprint real-time pipeline cleanly, but the new host-side plugin API client uses plain fetch and bypasses the app's axios 401 -> /auth/refresh interceptor queue. Plugin fetches will fail when the access cookie expires instead of recovering like host API calls.

Reviewed changes — sprint event topics, real-time cache invalidation, realtime permissions, plugin host base props/API client, and a new WASM db_query2 export.

• Sprint event topics and publishing — services/api/internal/events/topics.go adds sprint.*; sprint_service.go publishes after create, update, delete, and complete.
• Socket-driven sprints refresh — useProjectRealtime now invalidates ["projects", projectId, "sprints"], and the sidebar drops its 30s polling interval.
• Realtime permissions — services/realtime adds a sprints namespace gated by the existing sprints.read permission.
• Plugin host props — new usePluginBaseProps builds { api, ui, meta } and InteractionLayout forwards it plus viewId to plugin views.
• Plugin API client — new apps/web/src/lib/plugins/plugin-client.ts duck-types the SDK's PluginApiClient contract.
• WASM db_query2 — new export reports query execution errors back to plugins without changing the old db_query signature.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏}