Complete platform management workflows

openspec/changes/add-plugin-declared-remote-access/proposal.md

@@ -0,0 +1,29 @@
+## Why
+
+The platform needs one safe model for remote game server access across hosted files, run-managed hosts, databases, logs, and RCON. The old SCUM stack handled FTP/SFTP, run-side process control, SQLite queries, logs, and client commands in separate paths; the new platform must make those abilities plugin-declared before they can be used.
+
+## What Changes
+
+- Add plugin manifest metadata for declared remote access methods: `ftp`, `rsync`, and `run`.
+- Add remote run capabilities for remote file read/write, process start/stop, MySQL and SQLite query, log transfer, and RCON command dispatch.
+- Add platform registry and marketplace projection fields so operators can see which remote access methods a game plugin enables.
+- Add a platform-mediated bridge action for remote access requests that queues only capabilities declared by the installed plugin.
+- Extend run capability reporting and bounded remote job handling so MC and SCUM plugins can opt into the same contract.
+- Add first-party Minecraft and SCUM example manifests proving the shared declaration model.
+
+## Capabilities
+
+### New Capabilities
+
+- `plugin-declared-remote-access`: Plugin-declared remote server access through ftp, rsync, or run with scoped run jobs for remote files, lifecycle, database reads, log transfer, and RCON.
+
+### Modified Capabilities
+
+- None.
+
+## Impact
+
+- Affects `plugins/` manifest schema, manifest validator tests, and first-party example manifests.
+- Affects `platform/` domain, DTO, validators, service bridge dispatch, marketplace projections, docs, and tests.
+- Affects `run/` protocol capability constants, job validation, runtime capability reporting, worker execution, docs, and tests.
+- Does not add billing, cloud host sales, plugin-owned credentials, browser-to-run access, raw host paths, or raw database/RCON credentials in plugin pages.