ai-toolkit plugin: LoRA trainer with exclusive GPU lease

[AlienWalker1995]

Summary

• New v2 plugin ai-toolkit (ostris/aitoolkit, digest-pinned, gpu_pin: primary, no host ports): training runs route through v2/assets/lease-exec.py mounted at the UI's venv-python spawn seam — exclusive ops-controller lease, heartbeat, release on exit.
• Caddy :8443 SSO-gated site (the prebuilt Next.js UI has no basePath; root on :443 is Open WebUI's) + edge plugin port publish and oauth2-proxy rd= whitelist.
• Dashboard tile + :8443 SSO open-link (new ':port/' route form) + ops-api recreate allowlist + parity-set/test updates.

Depends on #87 (renewable leases) — merged.

Test plan

• v2/tests/test_plugins.py manifest invariants; tests/test_caddyfile_invariants.py :8443 SSO gate; parity sets updated (13 service plugins).
• Local: root suite 388 passed, v2 suite 239 passed.
• E2E (operator, post-merge): real LoRA run → llamacpp evicted → heartbeats → restore; Stop-button SIGINT path; kill-wrapper sweep path.

🤖 Generated with Claude Code