feat: 将插件 stdin 协议定为 v1，并按声明注入凭据

进程外插件改为只读环境变量和自身配置，避免读宿主 appsettings；宿主按 plugin.json 声明注入 LLM / OpenWeather 等凭据。

Plugins/weather/Program.cs

@@ -1,4 +1,5 @@
-// 进程外 Weather 插件。同样只做 stdio 适配，天气实现仍在 MAF1.Core。
+// 进程外 Weather 插件。stdio 适配 + 复用 MAF1.Core 的 WeatherAgent。
+// LLM / OpenWeather Key 只来自宿主注入的环境变量；天气站点配置读本插件目录的 appsettings.json。
 using MAF1.Agents.Weather;
 using MAF1.PluginContract;
 using MAF1.Tools;
@@ -8,9 +9,15 @@ using Microsoft.Extensions.Configuration;
 PluginRequest request = await PluginStdio.ReadRequestAsync();
 PluginStdio.ApplyCredentialsToEnvironment(request.Credentials);
 
-IConfiguration config = PluginStdio.LoadHostConfiguration();
+IConfiguration config = PluginStdio.LoadPluginConfiguration();
 AgentFactory factory = new(AgentFactory.Load(config));
 WeatherOptions weatherOptions = config.GetSection("Weather").Get<WeatherOptions>() ?? new WeatherOptions();
+string? openWeatherKey = Environment.GetEnvironmentVariable("OPENWEATHER_API_KEY");
+if (!string.IsNullOrWhiteSpace(openWeatherKey))
+{
+    weatherOptions.OpenWeather.ApiKey = openWeatherKey;
+}
+
 using HttpClient http = WeatherTools.CreateHttpClient();
 var result = await WeatherAgent.RunAsync(
     WeatherAgent.Create(factory, new WeatherTools(weatherOptions, http)),