refactor: collapse lumilake plugins into lumid_lumilake_plugin

[timzsu]

Summary

Add two new optional surfaces to lumid_lumilake_plugin — jobs auth and remote optimizer — alongside the existing identity provider. All three share one install() and one LUMILAKE_PLUGINS=lumid_lumilake_plugin entry; each new surface activates by env var:

• Identity — always on (existing behaviour).
• Jobs auth (PermissionChecker + ResourceRegistrar) — kind-agnostic SQLite ACL store; grants persist across restarts via reconcile. Activates when LUMID_LUMILAKE_ACL_DB_PATH is set.
• Remote optimizer (OptimizerProvider) — proxies schedule requests to a trusted upstream URL. Install-time catalog probe uses Lumilake's existing LUMILAKE_RUNTIME_TOKEN; per-job schedule calls forward the submitter's own lum.id bearer via upstream runtime_token_var, so every schedule is attributed to the real caller (no static service-account token on the user path). Activates when LUMILAKE_REMOTE_OPTIMIZER_URL is set.

Why

Lumilake needs grant-scoped permission checks for jobs/traces/artifacts and a way to delegate optimizer scheduling to a remote. Keeping both in the same plugin lets the lum.id identity core stay in one place — the same LumidIdentityProvider powers all three surfaces.

Test Plan

End-to-end against a kv.run-deployed Lumilake with a remote optimizer.