Multiple defense-in-depth fixes for the OCI install flow in
`services/api/app/services/plugin_manager.py`:

* Validate every `plugin_id` against a strict `^[a-z0-9_.-]+$` regex
  before it is ever used to construct an on-disk path. Prevents path
  traversal via `..`, NUL bytes, or absolute paths in manifest IDs.
* Validate OCI references with a conservative regex and refuse refs
  whose registry host substrings match cloud-metadata endpoints
  (`169.254.169.254`, `metadata.google.internal`, `metadata.azure.com`,
  etc.). Defense in depth against SSRF via plugin installs.
* Build the `oras pull` argv as a Python list (no shell) and place
  `--output <path>` before `--` so flags are parsed correctly while
  still preventing argv injection via the ref.
* After pull, walk the extracted tree and reject any symlinks before
  copying. Use a `_safe_copytree()` wrapper around `shutil.copytree`
  with `symlinks=False` and explicit per-file copies that re-check
  for symlinks at copy time. Prevents arbitrary file overwrite via
  malicious OCI layers.
* New `_select_extracted_plugin_dir()` helper picks the plugin root
  by looking for `plugin.yaml`/`plugin.json` rather than assuming a
  single top-level directory; rejects images with no manifest.
* Verify the plugin signature against the trusted keys directory
  *before* copying files into `AISOC_PLUGINS_DIR`. In `strict` trust
  mode, an unsigned or invalid plugin is rejected without ever
  touching the live plugins dir, eliminating the
  signature-verification-after-write race.

Tests
-----
106 new/updated tests in `services/api/tests/test_plugin_manager.py`
covering:
* `_validate_plugin_id` accept/reject matrix incl. `..`, NUL, `/`, `\`,
  empty, length cap.
* `_validate_oci_ref` accept/reject matrix incl. metadata hosts and
  malformed refs.
* `_assert_no_symlinks` detects symlinks anywhere in the tree.
* `_select_extracted_plugin_dir` for flat, single-subdir, and
  no-manifest layouts.
* `_safe_copytree` rejects symlinks at copy time.
* `install_from_oci` happy path, strict-mode unsigned rejection,
  signature-before-copy ordering, argv shape (`--output` before `--`,
  ref as sole positional after `--`), and rejection of metadata-host
  refs.

Docs
----
* `apps/docs/docs/operations/security.md` — new "OCI install hardening
  (H-3)" section under "Plugin trust" documenting each check and the
  operator-visible implications.
* `apps/docs/docs/deployment/env-vars.md` — added `PLUGIN_TRUST_MODE`
  and `PLUGIN_TRUSTED_KEYS_DIR` to the API service reference, with a
  link to the new security section.

Refs: H-3

Restores 'Python — Lint & Type-check' to green by satisfying the
repo-wide ruff lint + format gates that run across all services in CI.