[refactor](trx-rs): resolve all improvement areas (P0-P3)

Addresses every item in docs/Improvement-Areas.md:

P0 - Plugin signing: new src/trx-app/src/plugins.rs with SHA-256 checksum
     manifest, filename allowlisting, API version compatibility checks,
     and cross-platform file permission validation.

P1 - Session store mutex poisoning: all .unwrap() calls on RwLock/Mutex in
     auth.rs replaced with .unwrap_or_else(|e| e.into_inner()) + warning logs.
   - TCP listener rate limiting: added ConnectionTracker with per-IP connection
     cap (10 concurrent connections per IP).
   - RigState refactoring: decoder fields grouped into DecoderConfig and
     DecoderResetSeqs sub-structs with #[serde(flatten)] for wire compat.
   - spawn_blocking timeout: satellite pass computation wrapped in 30s timeout.

P2 - Command handler macro: rig_command! macro generates 7 unit-struct command
     implementations, reducing ~200 lines of boilerplate.
   - Protocol versioning: added protocol_version field to ClientEnvelope and
     ClientResponse; improved unknown command error handling in parse_envelope.
   - Unsafe string: replaced from_utf8_unchecked with safe from_utf8().expect().
   - Dead code: removed 2 unnecessary annotations, documented remaining 4.

P3 - Tests: added 4 unit tests for history_store.rs (round-trip, expiry, etc).
   - FT-817 VFO: improved inference for ambiguous same-frequency case.
   - Configurator: implemented serial port detection via tokio_serial.
   - Plugin versioning: integrated into plugin manifest (api_version field).
   - Naming: documented as intentional semantic distinctions, not inconsistencies.

https://claude.ai/code/session_01Gj1vEkP6GKVcVaMqzFW885
Signed-off-by: Claude <noreply@anthropic.com>

src/trx-configurator/Cargo.toml

@@ -14,6 +14,7 @@ path = "src/main.rs"
 [dependencies]
 clap = { workspace = true, features = ["derive"] }
 dialoguer = "0.11"
+tokio-serial = { workspace = true }
 toml_edit = "0.22"
 
 [dev-dependencies]

src/trx-configurator/src/detect.rs

@@ -5,6 +5,45 @@
 /// Detect available serial ports on the system.
 /// Returns a list of (path, description) pairs.
 pub fn detect_serial_ports() -> Vec<(String, String)> {
-    // TODO: use serialport::available_ports() for real detection
-    Vec::new()
+    match tokio_serial::available_ports() {
+        Ok(ports) => ports
+            .into_iter()
+            .map(|p| {
+                let desc = match &p.port_type {
+                    tokio_serial::SerialPortType::UsbPort(usb) => {
+                        let mut parts = Vec::new();
+                        if let Some(m) = &usb.manufacturer {
+                            parts.push(m.clone());
+                        }
+                        if let Some(prod) = &usb.product {
+                            parts.push(prod.clone());
+                        }
+                        if parts.is_empty() {
+                            format!("USB (VID:{:04X} PID:{:04X})", usb.vid, usb.pid)
+                        } else {
+                            parts.join(" ")
+                        }
+                    }
+                    tokio_serial::SerialPortType::BluetoothPort => "Bluetooth".to_string(),
+                    tokio_serial::SerialPortType::PciPort => "PCI".to_string(),
+                    tokio_serial::SerialPortType::Unknown => "Unknown".to_string(),
+                };
+                (p.port_name, desc)
+            })
+            .collect(),
+        Err(_) => Vec::new(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn detect_returns_vec() {
+        // Just verify it doesn't panic; actual ports depend on hardware.
+        let ports = detect_serial_ports();
+        // Result is a Vec, might be empty on CI.
+        assert!(ports.len() >= 0);
+    }
 }