fix(review): bugs, arch violations, design smells

P1 bugs:
- unix_launcher: shell_split respects quoted args (was split_whitespace)
- plugin-host: 5s timeout on external plugin search
- ui: handle engine init panic, wire error state
- ui-egui: read window config instead of always using defaults
- plugin-url: use OpenPath action instead of SpawnProcess+xdg-open

Architecture:
- remove WindowConfig (mirror of WindowCfg); use WindowCfg directly
- remove on_select closure from SearchResult (domain leakage)
- remove LaunchAction::Custom; add Plugin::on_selected + SearchEngine::on_selected
- apps: record frecency via on_selected instead of embedded closure

Design smells:
- frecency: extract decay_factor helper, write outside mutex
- apps: remove cfg(test) cache_path hack; add new_for_test ctor
- apps: stable ResultId using name+exec to prevent collision
- files: stable ResultId using full path instead of index
- plugin-host: remove k-launcher-os-bridge dep (WindowConfig gone)

crates/plugins/plugin-url/src/main.rs

@@ -10,7 +10,7 @@ struct Query {
 #[derive(Serialize)]
 struct Action {
     r#type: &'static str,
-    cmd: String,
+    path: String,
 }
 
 #[derive(Serialize)]
@@ -45,8 +45,8 @@ fn search(query: &str) -> Vec<Result> {
         description: url.clone(),
         score: 95,
         action: Action {
-            r#type: "SpawnProcess",
-            cmd: format!("xdg-open {url}"),
+            r#type: "OpenPath",
+            path: url.clone(),
         },
     }]
 }
@@ -112,7 +112,7 @@ mod tests {
     fn search_returns_result() {
         let results = search("https://example.com");
         assert_eq!(results.len(), 1);
-        assert_eq!(results[0].action.cmd, "xdg-open https://example.com");
+        assert_eq!(results[0].action.path, "https://example.com");
     }
 
     #[test]
@@ -124,7 +124,7 @@ mod tests {
     fn result_serializes() {
         let results = search("https://example.com");
         let json = serde_json::to_string(&results).unwrap();
-        assert!(json.contains("SpawnProcess"));
-        assert!(json.contains("xdg-open"));
+        assert!(json.contains("OpenPath"));
+        assert!(json.contains("https://example.com"));
     }
 }