manifest, thin proxy router, and the sidecar backend

ported from the standalone officer-atelier service: providers (adapter-shaped, openai the only
adapter today), the generation queue, collections, and the database layer — kept on its own
Postgres database rather than folded into officer_db, since both collections and provider_settings
had rows on the machine this was extracted from.

what changed rather than just moved:
- images are served from an authenticated GET /files/:filename instead of an unauthenticated
  PUBLIC_URL-prefixed static route
- the OpenAI-key bootstrap fallback reads the secret store (getSecret) before .env, per-adapter
- provider_settings (the one-row-per-adapter shape providers replaced) did not come along — it has
  no callers left anywhere in the server code, only a migration script that also did not move

ping/echo (smoke-test routes with no caller) did not move either; the sidecar's own /_health covers
liveness.

not yet wired into the platform: sidecar/index.ts exists but nothing mounts it, and web/ has not
been written, so this is not yet a discoverable plugin.

manifest.ts

@@ -0,0 +1,35 @@
+import type { PluginManifest } from '@@/plugins/manifest';
+
+// Atelier — image generation as a service: a provider-shaped API over OpenAI's image endpoints,
+// storing what it makes so every image has a durable reference inside Officer.
+//
+// Extracted 2026-08-20 from a standalone server (~/officer-dev/dockers/officer-atelier) that predates
+// the plugin system. See PLUGIN.md for what moved, what did not, and why — most notably that the
+// `atelier` Postgres database stays separate rather than folding into officer_db (both `collections`
+// and `provider_settings` had rows on the machine this was extracted from), and that generated images
+// are now served through an authenticated route instead of an unauthenticated `PUBLIC_URL`.
+//
+//   api/router.ts     a thin auth-gated proxy — no Atelier knowledge, and it must never grow app logic
+//   sidecar/          the whole image-generation contract: providers, the queue, the database
+//   web/              three panels — Generate, Gallery, Collections — and a layout
+//
+// Providers (which adapter, which model, whose key) is NOT a panel — it moved to
+// Settings → Integrations → Atelier, per PLUGIN.md's "Providers as a settings screen" decision.
+export const manifest: PluginManifest = {
+  publisher: 'officerdev',
+  version: '1.0.0',
+  platform: '>=1.0.0',
+
+  label: 'Atelier',
+  summary: 'Image generation — prompt, gallery, collections, backed by OpenAI’s image models',
+  icon: 'Palette',
+  color: '#f59e0b',
+
+  permissions: [
+    {
+      key: 'atelier',
+      label: 'Atelier',
+      description: 'Image generation: prompts, gallery, collections and provider configuration',
+    },
+  ],
+};