feat(FN-3400): add native shell connection handoff, plugin management CLI/l

This merge adds a complete plugin management system (FN-3565) with CLI commands, a loader, runner, and dashboard routes, along with project-scoped auth storage (FN-3544), native shell connection support for mobile (FN-3400) spanning onboarding, connection manager, and remote desktop handoff, and ref

Fusion-Task-Id: FN-3400

packages/mobile/src/plugins/connection-profiles.ts

@@ -17,7 +17,17 @@ function createId(): string {
 }
 
 function normalizeUrl(serverUrl: string): string {
-  return serverUrl.trim().replace(/\/$/, "");
+  const normalized = serverUrl.trim().replace(/\/$/, "");
+  let parsed: URL;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    throw new Error("Server URL must be a valid absolute URL");
+  }
+  if (!parsed.protocol || !/^https?:$/.test(parsed.protocol)) {
+    throw new Error("Server URL must use http or https");
+  }
+  return normalized;
 }
 
 function toPersisted(input: unknown): PersistedShellState {

packages/mobile/src/plugins/native-shell.ts

@@ -69,7 +69,9 @@ export class MobileNativeShellBridge implements FusionShellApi {
   }
 
   async openConnectionManager(): Promise<void> {
-    // Handled by dashboard shell context state.
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(new CustomEvent("shell:open-connection-manager"));
+    }
   }
 
   subscribe(listener: Listener): () => void {

packages/mobile/src/plugins/qr-scanner.ts

@@ -27,7 +27,7 @@ function parsePayload(raw: string): QrScanResult {
 
   try {
     const url = new URL(trimmed);
-    const authToken = url.searchParams.get("authToken");
+    const authToken = url.searchParams.get("authToken") ?? url.searchParams.get("rt");
     return {
       serverUrl: `${url.protocol}//${url.host}`,
       authToken,