app-shell: export the list of plugin crates an app crate must depend on directly, with a check in the app #891

Goal

app-shell states in code which Tauri plugin crates an app crate that embeds it must list as direct dependencies, and the community app checks its own Cargo.toml against that list in a test. A plugin added to app-shell later cannot be forgotten in an app crate again (the cause of #795).

Context

• The Tauri CLI only bundles the Android project of plugins that are direct dependencies of the app crate, and tauri-build only grants plugin permissions for direct dependencies (comment in apps/smart-ssh-community/Cargo.toml:30-35).
• apps/smart-ssh-community/Cargo.toml:35-50 lists by hand: tauri-plugin-dialog, tauri-plugin-notification, tauri-plugin-opener, tauri-plugin-os, tauri-plugin-store, desktop-only tauri-plugin-decoration, Android-only tauri-plugin-fs; after Android: ship the session service and microphone plugins as a plugin crate with an Android library module #888 also tauri-plugin-android-host.
• Nothing ties this list to what app-shell actually registers (register_unlocked_plugins_on, crates/app-shell/src/lib.rs:1079-1118, plus the decoration plugin and the plugin from Android: ship the session service and microphone plugins as a plugin crate with an Android library module #888). Issue Android: app aborts at launch (Keystore store without Android context, file plugin's Android part not bundled) #795 (app aborted at launch because tauri-plugin-fs's Android part was missing) is exactly this drift.
• docs/android-build.md section "App-Crates, die app-shell einbetten" describes the rule in prose only.

Requirements

• app-shell exports a public constant, e.g.

  pub struct RequiredPluginCrate { pub name: &'static str, pub target: PluginTarget }
  pub enum PluginTarget { All, DesktopOnly, AndroidOnly }
  pub const REQUIRED_DIRECT_PLUGIN_CRATES: &[RequiredPluginCrate] = &[…];

  listing every Tauri plugin crate app-shell registers, with the target it is registered for.
• A test inside app-shell keeps the constant honest: it reads crates/app-shell/Cargo.toml and asserts that every tauri-plugin-* dependency of app-shell (normal and target.* tables) appears in the constant with a matching target, and vice versa. Plugins that need no direct dependency of the app (no webview permissions and no Android part, today tauri-plugin-single-instance, crates/app-shell/Cargo.toml:60) stay out of the constant and are listed in an explicit exemption list in the test, each with a one-line reason.
• A test in apps/smart-ssh-community (tests/direct_plugin_deps.rs) parses its own Cargo.toml ([dependencies] and [target.'cfg(…)'.dependencies]) and asserts that every entry of the constant is a direct dependency for (at least) its target. Failure message names the missing crate and the table to add it to.
• The test is written so another app crate can copy it unchanged (it only uses app_shell::REQUIRED_DIRECT_PLUGIN_CRATES and CARGO_MANIFEST_DIR).
• docs/android-build.md: the Android: app aborts at launch (Keystore store without Android context, file plugin's Android part not bundled) #795 section points to the constant and the test instead of a prose list.

Acceptance Criteria

• app_shell::REQUIRED_DIRECT_PLUGIN_CRATES exists and lists exactly the tauri-plugin-* crates app-shell depends on, minus the documented exemptions, with targets.
• The app-shell self-check test fails when a tauri-plugin-* dependency is added to crates/app-shell/Cargo.toml without a constant entry (counter-check described in the test doc comment).
• apps/smart-ssh-community/tests/direct_plugin_deps.rs passes; removing e.g. tauri-plugin-os from the app's Cargo.toml makes it fail with a message naming tauri-plugin-os.
• Parsing uses a TOML parser (toml, already in Cargo.lock transitively; add it as a dev-dependency), no regex on TOML.
• docs/android-build.md updated.
• Relevant automated tests pass (cargo test --workspace, clippy).

Technical Notes

• Files: crates/app-shell/src/lib.rs (or a new small module required_plugins.rs re-exported at the root), apps/smart-ssh-community/tests/direct_plugin_deps.rs (new), apps/smart-ssh-community/Cargo.toml ([dev-dependencies] for toml if needed), docs/android-build.md.
• toml as a dev-dependency only; cargo deny check must stay green.
• No security-relevant code path is touched.

Spec impact: none

Open questions

• none

Related Work

• Android: app aborts at launch (Keystore store without Android context, file plugin's Android part not bundled) #795, Android: ship the session service and microphone plugins as a plugin crate with an Android library module #888 (blocks this issue)