Add Week 10 Plugin System and Week 11 Control API

Week 10 - Plugin System (FR-19):
- Plugin traits: Plugin, OriginPlugin, MetadataPlugin, FormatPlugin
- NativePluginHost with libloading for dynamic loading
- WasmPluginHost (feature-gated) with wasmtime runtime
- PluginManager coordinating both hosts with version checks
- OriginInstance::watch() with WatchHandle, WatchEvent for live updates
- FormatPlugin::synthesize_header() for metadata overlay

Week 11 - Control API & Production (FR-17, FR-18, NFR-6, NFR-10):
- gRPC server with full MusicFS service (status, cache, origins, events)
- Proto extended: MountState enum, TierStats, full StatusResponse/CacheStats
- WebhookHandler with HMAC-SHA256 signing and exponential retry
- Metrics with latency histograms (p50/p95/p99) and origin health gauges
- CLI with mount, status, cache, search, origin, events, shutdown commands
- E2E player compatibility tests (mpv, VLC, file manager)
- systemd service, PKGBUILD, RPM spec for packaging

Plans added for Weeks 10-14 covering P1 features.
All 154 tests passing.

musicfs/dist/musicfs.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=MusicFS - Metadata-Organized Music Filesystem
+After=network.target
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/musicfs mount --config /etc/musicfs/config.toml /mnt/music
+ExecStop=/usr/bin/musicfs shutdown
+Restart=on-failure
+RestartSec=5
+User=musicfs
+Group=musicfs
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/var/cache/musicfs /mnt/music
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target