…ble/disable (NousResearch#41066)

Salvage consolidating three complementary community PRs into one coherent fix:

- NousResearch#41076 (islam666): made `hermes plugins list` discover nested category
  plugins (e.g. `observability/nemo_relay`, `image_gen/openai`).
- NousResearch#41613 (mnajafian-nv): the superset — nested discovery aligned with the
  runtime loader (reuses `PluginManager._scan_directory`/`_scan_entry_points`
  so list state can't drift from what actually loads), PLUS the enable/disable
  mutation side NousResearch#41076 left flat.
- NousResearch#41081 (annguyenNous): identified the `web_server.py` dashboard plugins-hub
  caller of `_discover_all_plugins()`, which must also be updated for the new
  tuple shape + key-aware status.

This combines the best of all three and fixes the mutation-side gap that made
nested bundled plugins untoggleable:

    $ hermes plugins enable nemo_relay
    Plugin 'nemo_relay' is not installed or bundled.   # exit 1 (before)

Now `enable`/`disable`/`toggle`, the `hermes plugins list` views, the dashboard
plugins-hub endpoint, and the dashboard enable/disable helpers all resolve a
bare manifest name OR a full path-derived key to the canonical key the loader
gates on, via a single `_resolve_plugin_reference()` normalization point, and
persist that key while clearing any stale legacy bare-name alias so the two
can't drift. `_plugin_status` is key+legacy-name aware.

`_discover_all_plugins` now returns 6-tuples
`(key, legacy_name, version, description, source, dir_path)`; ALL call sites
(`cmd_list` table/plain/JSON, `_filter_plugin_entries`, `cmd_toggle`,
`dashboard_remove_user_plugin`, and `web_server._merged_plugins_hub`) and the
`test_plugins_cmd_list.py` fixtures are updated to match. Updating the
`web_server.py` caller prevents a `ValueError: too many values to unpack` crash
in the dashboard plugins-hub endpoint.

Verified e2e on the real CLI + runtime loader (isolated HERMES_HOME):
`hermes plugins enable nemo_relay` writes `observability/nemo_relay` to
config.yaml and the loader then loads it (`enabled=True, error=None`); a stale
bare-name alias is cleared on disable (no contradictory state); the dashboard
`_merged_plugins_hub()` runs and lists nested plugins by canonical key.
Full `tests/hermes_cli/test_plugins_cmd*` + web_server plugin tests green.

Closes NousResearch#41066. Supersedes NousResearch#41076, NousResearch#41081, and NousResearch#41613.

Co-authored-by: islam666 <islam666@users.noreply.github.com>
Co-authored-by: mnajafian-nv <mnajafian@nvidia.com>
Co-authored-by: annguyenNous <annguyenNous@users.noreply.github.com>
Co-authored-by: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com>