feat(FN-3785): add standalone HTML rendering and export routes for reports

Adds a complete HTML rendering and export pipeline to the fusion-plugin-reports plugin, including a standalone HTML renderer with template and stylesheet support, new export routes (`/api/reports/:id/export/html`) that persist rendered HTML to the store, and plugin-type support for non-JSON route re

Fusion-Task-Id: FN-3785

docs/PLUGIN_AUTHORING.md

@@ -455,6 +455,8 @@ const plugin: FusionPlugin = {
 };
 ```
 
+Route handlers may return either plain JSON values or a `PluginRouteResponse` envelope. `PluginRouteResponse` now supports optional `headers` and `contentType` fields so plugins can serve non-JSON payloads like downloadable HTML. Example: return `{ status: 200, body: html, contentType: "text/html; charset=utf-8", headers: { "Content-Disposition": "attachment; filename=\"report.html\"" } }` to send an attachment response directly from a plugin route.
+
 ### Route Mounting
 
 Routes are mounted at `/api/plugins/{pluginId}/{path}`.

docs/plugins/reports.md

@@ -0,0 +1,11 @@
+# Reports Plugin
+
+## Rendering & Export
+
+The reports plugin renders deterministic HTML via `src/render/html-template.ts` using ordered `data-section` blocks and tokenized styles from `src/render/html-styles.ts`. Section toggles and `sectionOrder` are respected from report settings metadata, and both dark/light themes are embedded directly in the output document (no dashboard stylesheet dependency).
+
+Standalone exports are produced by `renderStandaloneReportHtml` in `src/render/standalone-html.ts`. The export is fully self-contained (single document, inlined `<style>`, no remote CSS/fonts, and no non-allowlisted external `href/src` URLs). Exported HTML is cached back into the report store (`rendered_html`, `rendered_html_generated_at`) on first export.
+
+HTTP endpoints:
+- `GET /api/plugins/fusion-plugin-reports/reports/:id/export.html` → attachment download (`Content-Disposition` + `text/html`)
+- `GET /api/plugins/fusion-plugin-reports/reports/:id/preview.html` → body-only HTML fragment for embedded preview viewers