feat: clear stale plugin data and persist OAuth users to config

- hbdclass: add per-plugin stale timers; clear history and alerts after
  3× heartbeat interval with no PLG data received
- udp: wire stale timer on every PLG message via _make_plugin_stale_callback
- http: persist new OAuth users to config file on first login

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hbd/server/http.py

@@ -1182,6 +1182,23 @@ async def start(
             profile["full_name"],
             profile["avatar_url"],
         )
+        # Persist new OAuth users to the config file so they survive restarts.
+        # Only write when the user isn't already in the config's users section.
+        if _config_path and not (config.get("users") or {}).get(user.username):
+            try:
+                disk_data = configio_mod.read_roundtrip(_config_path)
+                if not disk_data.get("users"):
+                    disk_data["users"] = {}
+                disk_data["users"][user.username] = {
+                    k: v for k, v in [
+                        ("full_name", user.full_name),
+                        ("avatar", user.avatar),
+                    ] if v
+                }
+                configio_mod.write_config(_config_path, disk_data)
+                logger.info("Persisted OAuth user %r to config", user.username)
+            except Exception as exc:
+                logger.warning("Failed to persist OAuth user %r to config: %s", user.username, exc)
         session_token = users_mod.create_session(user.username)
         eventlog("hbd", "INFO", f"Login: {user.username} via {provider.type}")
         resp = web.HTTPFound("/")