feat(jev): add configurable native evaluation plugin

[me2seeks]

Summary

Adds maka.jev as a statically linked Rust plugin on feat/runtime-host-rust.

• Publish maka.jev.evaluate for explicitly injected native/JSON consumers with admitted caller scopes.
• Support System One noul/choice/score evaluations, custom endpoint/model/timeout, API key and custom request headers.
• Add a Desktop Settings Client. Authentication and header values stay in URL-bound Host credentials; config writes use revision checks.
• Preserve uncertain POST outcomes, drain scoped HTTP resources, and block incognito calls. No redirects or automatic retries.

Provider token usage is returned as metadata; it is not recorded as Host chat-model usage. Service settings are Profile-wide. See crates/jev/README.md for the consumer contract.

Verification

• cargo test -p maka-jev --lib: 5 passed.
• cargo test -p maka-runtime-host --test integration jev_plugin: 1 passed, covering actual consumer injection/admission refusal, Remote configuration, CAS conflicts, secret non-disclosure, endpoint isolation, retirement and restart.
• cargo clippy -p maka-jev --all-targets -- -D warnings, cargo fmt --all --check, git diff --check: passed.
• SDK/core/UI builds, focused Jev Client strict TypeScript check, and focused Biome lint/format: passed.
• Browser check of the actual Client in an isolated mock-Remote preview: custom URL, save gating, custom Authorization and headers, secret clearing and saved-config test gating. This is not a full Electron end-to-end test.
• Independent GPT-6 Luna audit identified uncertain-outcome and consumer-path coverage issues; addressed and verified before submission.

No paid live TypeSafe request or repository-wide test suite was run.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the plugin; GPT-6 Luna audited the authorization, lifecycle and service boundaries. Commit includes Generated-by: Codex.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No