Add permanent redirects plugin

[owjs3901]

Summary

• add the Redirects plugin with administrator CRUD, audited configuration events, Vespertide migration, and a management screen
• introduce the plugin redirect-resolver hook so enabled exact rules issue 308 before authentication and static fallback
• validate canonical internal paths and HTTPS destinations; reserve API and framework asset paths
• register the plugin in example-app, document its behavior, and cover API/OpenAPI plus assembled-system redirect ordering

Verification

• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --quiet
• bun install --frozen-lockfile
• TypeScript checks for every tsconfig and bunx oxlint (one pre-existing auth UI warning)
• RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps
• cargo run -p yeollin-cli -- build --skip-backend
• cargo run -p yeollin-cli -- plugin doctor
• real browser QA: authenticated administrator created a redirect through /redirects and browser navigation received 308 for /browser-legacy before landing at /redirects