Add per-user Toyota integration with a settings cascade

Let each user run the Toyota Connected plugin under their own MyToyota
credentials and enable/disable it for themselves in the Web App, while a
superadmin (and, in an organization, an org admin) can impose settings
from above. Resolution is a cascade — top wins, and a lower level only
fills fields the levels above left blank:

  - org user:      API Server (superadmin) -> org admin -> user
  - org-less user: API Server (superadmin) -> user

The MyToyota email + password resolve together as a pair from the highest
layer that supplies an email; brand resolves on its own; enablement is
strictly per-user, gated by the global master switch and the org gate.

API Server:
  - plugins.Manager gains RawConfig / HealthCheckWith / InvokeWith so the
    cascade can read global config and probe/invoke under a per-caller
    resolved config.
  - internal/api/integrations.go resolves the cascade and serves
    GET/PUT /api/integrations/toyota, POST .../health, GET .../vehicles.
    Secrets and inherited usernames are masked before leaving the server.
  - The toyota builtin's credentials are no longer required at the global
    layer, so the master switch can be enabled without global credentials.
  - setup-pocketbase.mjs adds a pluginSettings JSON field to the users and
    organizations collections (the user and org layers of the cascade).

Web App:
  - api.js gains getToyota/saveToyota/testToyota.
  - Settings grows an Integrations section: an enable toggle, credential
    fields with locked / "inherited from" states, a brand select, an
    org-scope switch for admins, and a live test-connection button.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API Server/internal/plugins/manager.go

@@ -321,6 +321,66 @@ func (m *Manager) HealthCheck(ctx context.Context, name string) (Health, error)
 	return h, nil
 }
 
+// HealthCheckWith probes a plugin against a caller-resolved config rather than
+// the stored global config. It builds a transient instance, Inits it with cfg,
+// probes, and tears it down — so a per-user cascade (see internal/api/
+// integrations.go) can health-check under the credentials in force for that
+// caller without disturbing the global instance or its cached health.
+func (m *Manager) HealthCheckWith(ctx context.Context, name string, cfg map[string]string) (Health, error) {
+	m.mu.Lock()
+	rec := m.records[name]
+	p := construct(name, m.factories[name], rec)
+	m.mu.Unlock()
+
+	if p == nil {
+		return Health{}, errUnknown
+	}
+	_ = p.Init(ctx, cfg)
+	defer func() { _ = p.Shutdown(context.Background()) }()
+	return p.HealthCheck(ctx), nil
+}
+
+// InvokeWith runs a capability against a caller-resolved config. Like
+// HealthCheckWith, it uses a transient instance Inited with cfg so per-user
+// credentials drive the call. Returns the plugin's raw JSON result.
+func (m *Manager) InvokeWith(ctx context.Context, name string, cfg map[string]string, action string, payload json.RawMessage) (json.RawMessage, error) {
+	m.mu.Lock()
+	rec := m.records[name]
+	p := construct(name, m.factories[name], rec)
+	m.mu.Unlock()
+
+	if p == nil {
+		return nil, errUnknown
+	}
+	_ = p.Init(ctx, cfg)
+	defer func() { _ = p.Shutdown(context.Background()) }()
+	return p.Invoke(ctx, action, payload)
+}
+
+// RawConfig returns a copy of a plugin's stored (global) config and its enabled
+// flag. ok is false for an unknown plugin. This is the top layer (L1) of the
+// per-user cascade: the config a superadmin set in the panel, which lower layers
+// inherit blank fields from. Secrets are returned in clear — callers must mask
+// before returning anything to a client.
+func (m *Manager) RawConfig(name string) (cfg map[string]string, enabled, ok bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	_, isBuiltin := m.factories[name]
+	rec := m.records[name]
+	if !isBuiltin && rec == nil {
+		return nil, false, false
+	}
+	out := map[string]string{}
+	if rec != nil {
+		for k, v := range rec.Config {
+			out[k] = v
+		}
+		enabled = rec.Enabled
+	}
+	return out, enabled, true
+}
+
 // Shutdown tears down every live plugin instance. Wire into graceful shutdown.
 func (m *Manager) Shutdown(ctx context.Context) {
 	m.mu.Lock()