feat(plugins): isolate device integrations

plugins/xgrids-k1/README.md

@@ -3,9 +3,11 @@
 This directory is the package boundary for the first Mission Core device
 plugin. It now owns the canonical v1alpha2 manifest
 [`plugin.manifest.json`](plugin.manifest.json). The statically linked frontend
-contribution lives in `apps/control-station/src/device-plugins/xgrids-k1/`; the
-verified backend implementation remains temporarily in `src/k1link` so the
-real-device path stays operational during extraction.
+contribution lives in [`frontend/`](frontend/) beside the manifest and profiles;
+its provisioning, acquisition/replay, diagnostics and metrics are separate
+plugin-owned components. The
+verified backend implementation is physically isolated in
+`src/k1link/device_plugins/xgrids_k1/`.
 
 The v1alpha2 catalog can describe one or more independently profiled models.
 This manifest currently exposes only `xgrids.lixelkity-k1`, and the transitional
@@ -27,6 +29,8 @@ The plugin owns:
 - exact-profile left/right RTSP producer selection, H.264 copy-remux preview and
   the handoff of acquisition-owned init/fMP4/index evidence to the host archive;
 - K1-specific operator instructions and compatibility tests.
+- the scoped React `device.connection` contribution and its BLE/Wi-Fi and
+  acquisition pipeline UI.
 
 The plugin does not own:
 
@@ -35,19 +39,20 @@ The plugin does not own:
 - the host observation catalog, RRD preparation/cache, recorded-camera player,
   workspace layout, platform storage, remote transport, or other devices.
 
-Until extraction is complete, `src/k1link` is the compatibility source of
-truth and every move into this package must preserve replay and real-device
-acceptance.
+The `k1link` distribution and CLI names remain compatibility names. All
+device-specific implementation behind them is plugin-owned, and every change
+must preserve replay and real-device acceptance.
 
 Mission Core imports this plugin only from
 `apps/control-station/src/composition/devicePlugins.ts`. The generic shell never
 branches on this plugin ID or reads `k1_ip`, BLE candidates, MQTT topics, or
-other vendor state.
+other vendor state. The frontend contribution imports the host only through
+`@mission-core/plugin-sdk`; its CSS is scoped below `.xgrids-k1-plugin`.
 
 Backend startup loads the reviewed factory declared by `backendEntrypoint`, then
 cross-checks its plugin ID and complete action set against this manifest.
 Actions enter through the host dispatcher and the transitional facade
-`src/k1link/web/xgrids_k1_facade.py`. The old flat routes live in the plugin's
+`src/k1link/device_plugins/xgrids_k1/facade.py`. The old flat routes live in the plugin's
 legacy router; both paths delegate to the same proven
 `XgridsK1CompatibilityService` methods. Synchronous capture/runtime operations
 run outside the FastAPI event loop.
@@ -55,9 +60,10 @@ run outside the FastAPI event loop.
 Model switching calls the plugin deactivation hook. An active acquisition uses
 semantic `acquisition.stop` in `capture-only` mode; replay and pre-v1alpha2
 sessions retain the legacy `stream.stop` shim. Neither path claims that the
-physical K1 stopped without separate operator evidence. BLE, MQTT, codec and
-evidence modules remain in `src/k1link` until replay parity and another physical
-K1 regression are complete.
+physical K1 stopped without separate operator evidence. BLE, MQTT, codec,
+archive discovery and RRD export modules now live under the plugin package
+after replay parity and physical K1 regression. Process isolation and signed
+deployment remain later supervisor gates.
 
 The compatibility profile is descriptive and cannot itself authorize a vendor
 write. The current runtime cannot inspect K1 firmware: it keeps the profile