[zumbrunn]

Slice 1 of the @dune/plugin-api extraction (duneorg/dune#64). Stacked on #12 (snake_case config); base is that branch. Draft until #12 and core 0.36 are out.

Uses the PluginServices object core now hands to mount() (duneorg/dune#101) instead of importing from core:

• security (sanitiser, SSRF-guarded fetch, body limits, client IP, password policy, safe YAML), rate limiting, sessions, users, passwords, logger
• AdminContext.services; session manager, auth middleware, collab, webhooks and workflow actions take services
• isDuneError(err, "ssrf_blocked") instead of instanceof
• removed the hashPassword / verifyPassword / DUMMY_HASH re-exports from src/admin/mod.ts; createSessionManager is now async and takes services

Value imports from these five core modules go from 21 sites to 0; distinct core value names from 45 to 25. Admin sessions now pick up session_store.prefix from core.

Tests and deno task check pass (237) against unreleased core 0.36 (scratch workspace). Not mergeable until @dune/core is bumped to ^0.36.0 in deno.json and CORE_RANGE.

🤖 Generated with Claude Code

[zumbrunn]

Landed in 4.0.0 as part of #26 (one squash of the whole stack: its intermediate commits only type-check against the final contract). Verified against the published @dune/core 0.36.0 and @dune/testing 2.0.0.