chore: one client-externals table, client wiring and card tests, retired source ids stay valid

[MyPrototypeWhat]

These are the three follow-ups from the 0.2.0 port's final review. None of them changes how the plugin behaves for current users.

Changes

• One client-externals table (build:). The nine platform seed ids now live only in scripts/client-externals.json. tsdown.config.ts and scripts/check-client-bundle.mjs both read that file, so the two lists can no longer drift apart. The bundle check now validates every string-literal require("…") in lib/client.js. Before, it checked only @deepseek-ai/*. If a stray dependency is pulled into the bundle, the check names it and fails. The build-time file does not ship, so the npm package still has 56 files.
• Client wiring and card tests (test:). These run against a fake cordis context and typed fakes of the slot registry and of configForms.
  • The toolview is registered under its key and registrant.
  • The settings page is registered only while dsh serves the refkit namespace. That includes the case where the namespace is already served at load.
  • On teardown the page is unregistered and its controller disposed.
  • The plugin degrades without throwing when settings services are missing or throw.
  • RefkitCard renders correctly in every phase: preparing, start, result, error, plain text and the JSON-text fallback. The tests use react-dom/server, a new dev dependency.
• Retired source ids stay valid (feat(config):). Retired ids are accepted by the sources schema through RETIRED_IDS, which is empty today, and by the settings page through RETIRED_SOURCE_IDS.
  • The help text still lists only live ids.
  • A test keeps SHIPPED_IDS, the frozen list of ids that have shipped, exactly equal to the live ids plus the retired ids. Adding a provider then forces its id to be appended, and removing one forces a move to RETIRED_IDS. Without that move, a user's stored whitelist would fail the plugin at startup.

Testing

• The test count went from 115 to 145, and the full gate passes: typecheck, lint, test, build, the client bundle check and the host smoke. lib/ is rebuilt and committed. The client bundle changed only by the RETIRED_SOURCE_IDS table.
• Mutation checks in a scratch copy:
  • Removing poetrydb from the registry fails the shipped-ids guard, with a message that says what to do.
  • Adding an id without appending it fails the completeness test.
  • Injecting require("left-pad") into the bundle fails the new check. The old check let it pass.
• A reviewer independently ran 14 more mutations against these tests. Two survived plus one fake gap, and the fix round closed those three.
• To confirm on this PR: tsdown loading the JSON import attribute in tsdown.config.ts under CI's Node 22.

Not in this PR

When a sources whitelist holds only retired ids, it enables nothing, and the first call fails with the generic "no sources enabled" error. A clearer message can come in a later release. It cannot happen while RETIRED_IDS is empty.