feat(plugins): make CCAM installable straight from a Claude Code plugin

Adds a root `ccam` plugin (`.claude-plugin/plugin.json`, `"source": "./"`) so
`/plugin marketplace add` + `/plugin install ccam@...` is enough on a machine
with nothing but Claude Code: no clone, no npm run setup, no manual npm start.

- scripts/plugin-bootstrap.js: SessionStart hook. Fast-path exit, Node >=22.5
  gate (node:sqlite), mkdir lock with stale reclaim, deps installed into
  ~/.claude/agent-dashboard/runtime/ (never the plugin cache), legacy
  checkout-hook cleanup (backed up), ~/.local/bin/ccam launcher, eager UI
  build so client routes like /run work immediately, detached server spawn.
- scripts/plugin-open.js, scripts/plugin-doctor.js: /ccam-open, /ccam-doctor.
- server/index.js: DASHBOARD_CLIENT_DIST override (plugin cache is read-only).
- mcp/build/ is committed (plugin MCP servers start before any bootstrap could
  build them) and kept honest by scripts/check-mcp-build.js (content hash,
  not mtime), enforced by pre-commit when mcp/src changes.
- plugins/ccam-dashboard/.mcp.json moved under plugins/ccam/ with a working
  ${CLAUDE_PLUGIN_ROOT} path (the old relative path never resolved from a
  marketplace-cached subdir).
- Docs: README, INSTALL, SETUP, ARCHITECTURE, CLAUDE.md, docs/PLUGINS.md,
  docs/MCP.md, docs/CLI.md, docs/HOOKS.md.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

ARCHITECTURE.md

@@ -1118,6 +1118,29 @@ flowchart TD
 
 **Preserves existing hooks** -- only adds or updates entries containing `hook-handler.js`.
 
+### Plugin installs declare the same hooks instead
+
+When the dashboard is installed as the `ccam` Claude Code plugin, the eight hook
+entries come from the inline `hooks` block in `.claude-plugin/plugin.json`
+(each running `${CLAUDE_PLUGIN_ROOT}/scripts/hook-handler.js`), and
+`install-hooks.js` is not used at all. Both at once would POST every event twice
+— events carry no id, so ingest cannot deduplicate them, and every token and
+cost figure would double. Two guards keep that from happening silently:
+
+- `scripts/plugin-bootstrap.js` strips `hook-handler.js` entries out of
+  `~/.claude/settings.json` on session start (backing the file up as
+  `settings.json.ccam-bak` first) and logs what it removed.
+- `install-hooks.js` warns when the plugin runtime state exists, and
+  `/ccam-doctor` reports any surviving duplicates as a `FAIL`.
+
+`scripts/plugin-bootstrap.js` also owns the rest of the plugin's runtime: the
+Node >= 22.5 gate (`node:sqlite`), an atomic `mkdir` lock, the dependency
+install into `~/.claude/agent-dashboard/runtime/`, the `~/.local/bin/ccam`
+launcher, and the detached server spawn with `NODE_PATH` and
+`DASHBOARD_CLIENT_DIST` pointed at that runtime directory. It never writes into
+the plugin cache, which Claude Code garbage-collects and replaces on every
+update. Full behavior: [`docs/PLUGINS.md`](docs/PLUGINS.md).
+
 ---
 
 ## Import Pipeline