Install bundled server plugins automatically from CHIM

[RANGROO]

Summary

• replace the launcher/manual package broker with a game-driven package API
• use the plugin name as the canonical identity and install to ext/<Plugin Name>
• accept ordinary .zip packages and retain .dwpkg for backward compatibility
• support probe, sequential chunk upload, transactional activation, mutable paths, SQL migrations, and rollback
• reject traversal, symlinks, unsupported payloads, checksum mismatches, identity mismatches, oversized archives, and out-of-order chunks
• show automatically installed packages in Server Plugins without a manual upload control

Package contract

A schema-v4 package is a standard ZIP archive named <version>.zip or <version>.dwpkg and contains only:

• manifest.json
• checksums.sha256
• server/**

The game-side folder name and archive filename provide the expected plugin name and version. No package ID is required.

Validation

• PHP lint passed for all changed PHP files
• focused PHPUnit suite: 9 tests, 78 assertions
• live Apache package API returned HTTP 200 with the updated ZIP gate deployed
• local Apache chunk uploads installed CHIM-Custom and aiagent_nsfw
• CHIM-Custom migrations completed and case-insensitive probes reported installed versions as current

Security review

Package integrity and extraction safety are enforced identically for .zip and .dwpkg, but publisher authenticity is not yet cryptographically signed. Keep this draft until the package trust boundary is approved.