refactor(plugin): split plugin contract into partials and align namespaces

[rian-be]

Summary

Splits the monolithic IAuthKitPlugin contract from one 446-line file into per-concern partial declarations and moves them into a PluginContract/ folder whose namespace mirrors the directory layout. The contract surface is now referenced through the explicit AuthKit.Plugins.Abstractions.Contracts.PluginContract namespace instead of the loose Contracts root. Purely organizational, zero behavior change: the single IAuthKitPlugin type and every default-implemented member survive intact.

Contract split (Contracts/PluginContract/)

• IAuthKitPlugin.cs - base identity and metadata accessors (Id, Name, ..., Metadata)
• IAuthKitPlugin.HostRequirements.cs - MinHostVersion, DependsOn
• IAuthKitPlugin.Configuration.cs - ConfigureServices overloads, BindConfiguration
• IAuthKitPlugin.Health.cs - CheckHealthAsync
• IAuthKitPlugin.Pipeline.cs - MiddlewareType, MapEndpoints, ConfigureApplication, ConfigurePipeline
• IAuthKitPlugin.Security.cs - GetSecuritySchemes, ConfigureAuthentication, ConfigureAuthorization
• IAuthKitPlugin.Lifecycle.cs - lifecycle hooks, GetHostedServices

The interface deliberately stays a single type (partial interface IAuthKitPlugin). Role sub-interfaces would break host hook detection, which relies on reflection that distinguishes overrides through DeclaringType != typeof(IAuthKitPlugin).

Namespace alignment

• contract renamed to AuthKit.Plugins.Abstractions.Contracts.PluginContract
• DevTokens/DevTools and the example plugin reference it via using IAuthKitPlugin = AuthKit.Plugins.Abstractions.Contracts.PluginContract.IAuthKitPlugin;
• host, tests, and the AuthKit.PluginContractValidator tool updated to the explicit namespace

Plugin context configuration

• DevTokensPlugin and DevToolsPlugin now implement ConfigureServices(IServiceCollection, AuthKitPluginContext) and bind options from the plugin-scoped context.Configuration section instead of a hard-coded root section
• appsettings.json DevTokens options move from the AuthKit: root to Plugins:authkit.devtokens

Validation

• dotnet build AuthKit.slnx completes with zero errors
• 94/94 Host unit tests, 32/32 Abstractions, and 10/10 integration tests pass
• no logic changes: the diff is namespace/using renames, the partial split, and context-based option binding only

Result

The plugin contract is browseable instead of one wall of text: identity/host requirements, configuration, health, pipeline, security, and lifecycle hooks are each discoverable at a glance, every file's namespace matches its location, and the reference plugins demonstrate the context-scoped configuration pattern.