Move plugin-contract.md into README's Building plugins section; remove docs/, repoint all references

src/http/safe-url.ts

@@ -3,7 +3,7 @@
 //   safeUrl(value)  — sanitise an untrusted URL before rendering it in an href/src attribute.
 //                     Partials escape *text*, but a URL field is emitted verbatim, so a
 //                     `javascript:`/`data:` URL from upstream/user data would be live XSS. The
-//                     contract (docs/plugin-contract.md) is: a relative or http(s) URL is allowed,
+//                     contract (README.md → Routes & handlers) is: a relative or http(s) URL is allowed,
 //                     anything else collapses to "#". Exported to plugins via plugin-api.ts.
 //
 //   localPath(value) — validate a redirect target is a *same-origin* path (the redirect-URI

src/plugin-host/hooks.ts

@@ -1,5 +1,5 @@
 // Plugin lifecycle hooks: the host invokes the optional PluginHooks a plugin may declare
-// (docs/plugin-contract.md → Hooks). No sandbox — a throwing hook fails loud (boot for onBoot, the
+// (README.md → Hooks). No sandbox — a throwing hook fails loud (boot for onBoot, the
 // request for the others). Hooks run in discovery order (plugins sorted by id). app.ts skips these
 // entirely when no plugin declares the hook, so the no-hooks hot path stays free.
 

src/plugin-host/plugin-api.ts

@@ -2,7 +2,7 @@
 // stable contract: definePlugin + the manifest/handler types, the RequestContext, the auth guards,
 // and the request-body/CSRF/list-query helpers the blessed pattern needs. This barrel *is* the
 // contract boundary in code — the host may refactor any other src/* freely as long as it holds, so
-// a plugin should import from here, never reach into deeper modules. See docs/plugin-contract.md.
+// a plugin should import from here, never reach into deeper modules. See README.md → Building plugins.
 
 export { definePlugin } from "./plugin.ts";
 export type { HttpMethod, Plugin, PluginHooks, PluginManifest, PermissionDecl, Route, RouteHandler, RouteResult } from "./plugin.ts";

src/plugin-host/plugin.ts

@@ -1,5 +1,5 @@
 // The plugin contract — the product's main API surface: the machine-readable types +
-// pure rules; `docs/plugin-contract.md` is the prose reference, discovery/router wire it to FS+HTTP.
+// pure rules; README.md (Building plugins) is the prose reference, discovery/router wire it to FS+HTTP.
 // Powerful, predictable, fails loud at boot/discovery rather than sandboxing at runtime.
 //
 // A plugin's identity is its folder under plugins/: folder name = `id` (isValidPluginId), mount =
@@ -123,7 +123,7 @@ export interface VersionCheck {
   message: string;
 }
 
-// Provider/consumer semver check (full table in docs/plugin-contract.md): same major+minor → ok,
+// Provider/consumer semver check (full table in README.md → Contract versioning): same major+minor → ok,
 // plugin minor < host → warn, else (newer minor, major mismatch, malformed) → refuse. Patch is
 // ignored. Discovery maps refuse→throw, warn→log.
 export function checkApiVersion(pluginVersion: unknown, hostVersion: string = HOST_API_VERSION): VersionCheck {