fix(build): scaffold plugins under plugins/<vendor>/<name> (quick-261028-pq8)

- make:plugin writes plugins/<vendor>/<name> with module
  <app>/plugins/<vendor>/<name>; the package name stays <name>
- make:* and the models-leaf check look in summer.yaml, then
  plugins/<vendor>/<name>, then the older plugins/<name>
- summer new puts its starter plugin at plugins/golem15/<name>
- refuse a vendor directory that is a legacy plugin module and a second
  copy of a plugin that already sits in plugins/<name>
- help text and docs, with an upgrading note: moving is optional

internal/build/testdata/new/CLAUDE.md.golden

@@ -21,8 +21,8 @@ summer build                       # generate main.go and plugins.gen.go, build
 summer dev                         # watch sources and rebuild
 summer migrate                     # run plugin migrations
 summer serve                       # start the HTTP server
-summer make:plugin golem15.<name>  # scaffold a plugin module under plugins/<name>
-summer plugin:add plugins/<name>   # register it in summer.yaml, go.mod and go.work
+summer make:plugin golem15.<name>          # scaffold a plugin module under plugins/golem15/<name>
+summer plugin:add plugins/<vendor>/<name>  # register it in summer.yaml, go.mod and go.work
 summer make:admin-controller golem15.<plugin> <Name>  # scaffold an admin controller with its YAML
 summer admin:create --email you@example.com --superuser  # create a backend administrator (password prompted)
 ```
@@ -30,7 +30,7 @@ summer admin:create --email you@example.com --superuser  # create a backend admi
 ## Layout
 
 - `summer.yaml`: the application manifest (module path, binary name, ordered plugin list).
-- `plugins/`: local plugin modules. `plugins/demo` is the starter plugin `golem15.demo`; its `routes.go` answers `GET /` with JSON.
+- `plugins/`: local plugin modules, one directory per vendor (`plugins/<vendor>/<name>`). `plugins/golem15/demo` is the starter plugin `golem15.demo`; its `routes.go` answers `GET /` with JSON.
 - `config/`: YAML configuration (`app.yaml`, `database.yaml`, `http.yaml`, `log.yaml`, `storage.yaml`). Any key can be overridden with a `SUMMER_` environment variable, a double underscore separating path segments (`SUMMER_DATABASE__DSN` sets `database.dsn`).
 - `.env`: local secrets (database DSN, application key, admin token secret). Never commit it; `.gitignore` excludes it. `.env.example` lists the variables.
 - `compose.yaml`: the local PostgreSQL 16.

internal/build/testdata/new/go.mod.golden

@@ -5,10 +5,10 @@ go 1.27.0
 toolchain go1.27.0
 
 require (
-	git.golem15.com/golem15/sm-demo-app/plugins/demo v0.0.0
+	git.golem15.com/golem15/sm-demo-app/plugins/golem15/demo v0.0.0
 	git.golem15.com/golem15/summercms v0.0.0
 )
 
 replace git.golem15.com/golem15/summercms => ../summercms
 
-replace git.golem15.com/golem15/sm-demo-app/plugins/demo => ./plugins/demo
+replace git.golem15.com/golem15/sm-demo-app/plugins/golem15/demo => ./plugins/golem15/demo

internal/build/testdata/new/go.work.golden

@@ -4,5 +4,5 @@ toolchain go1.27.0
 
 use (
 	.
-	./plugins/demo
+	./plugins/golem15/demo
 )

internal/build/testdata/new/plugins.gen.go.golden

@@ -3,7 +3,7 @@
 package main
 
 import (
-	_ "git.golem15.com/golem15/sm-demo-app/plugins/demo"
+	_ "git.golem15.com/golem15/sm-demo-app/plugins/golem15/demo"
 )
 
 // PluginIDs is the ordered plugin list from summer.yaml.

internal/build/testdata/new/summer.yaml.golden

@@ -2,4 +2,4 @@ module: git.golem15.com/golem15/sm-demo-app
 binary: demo
 plugins:
   - id: golem15.demo
-    module: git.golem15.com/golem15/sm-demo-app/plugins/demo
+    module: git.golem15.com/golem15/sm-demo-app/plugins/golem15/demo