## Why

The plugin SDK and authorization contract exist, but plugin pages still cannot execute real platform-mediated bridge actions from the management console. Operators need plugin UI pages to request allowed server, job, log, artifact, file, and AI capabilities through a host bridge that keeps platform auth, run sockets, host paths, and provider credentials hidden.

## What Changes

- Add frontend plugin page host execution utilities for creating safe bridge sessions and dispatching bridge action requests through platform APIs.
- Add platform bridge execution routes/services that authorize each request and fan out only to existing safe platform capabilities.
- Add plugin SDK/example coverage for request envelopes and host-mediated response/error handling.
- Update plugin page documentation and tests to prove unsupported actions, missing permissions, raw paths, sockets, credentials, and raw AI keys are rejected.
- Add browser walkthrough for an embedded plugin page workflow.

## Capabilities

### New Capabilities

- `plugin-page-bridge-execution`: Executes plugin page bridge requests through the platform host and backend authorization layer without exposing unsafe internals.

### Modified Capabilities

- Builds on `plugin-bridge-and-sdk`, `config-write-and-file-dispatch`, `platform-mediated-ai-invocation`, and artifact/log/job capabilities as they become available.

## Impact

- Affects `platform/`, `platform_web/`, and `plugins/`.
- Adds backend DTO/service/API behavior for bridge execution, frontend bridge host transport, SDK/example tests, and documentation.
- Does not add direct plugin-to-run access, direct platform auth sharing, raw credentials, host path exposure, billing, cloud host sales, or unrelated marketplace features.