feat(plugins): install npm sources and review CLI updates

Treat install selectors as one-time choices. Keep source identity separate from the installed revision, and resolve ordinary updates from the current upstream default. npm only acquires directories; plugin loading remains independent of npm.

package-lock.json

@@ -39022,6 +39022,7 @@
         "pino-pretty": "^13.1.3",
         "qrcode": "^1.5.4",
         "rotating-file-stream": "^3.2.9",
+        "semver": "^7.8.5",
         "sherpa-onnx-node": "1.12.28",
         "strip-ansi": "^7.1.2",
         "tree-kill": "^1.2.2",
@@ -39728,6 +39729,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "packages/server/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "packages/server/node_modules/strip-ansi": {
       "version": "7.1.2",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",