feat: clear stale plugin data and persist OAuth users to config

- hbdclass: add per-plugin stale timers; clear history and alerts after
  3× heartbeat interval with no PLG data received
- udp: wire stale timer on every PLG message via _make_plugin_stale_callback
- http: persist new OAuth users to config file on first login

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hbd/server/udp.py

@@ -232,6 +232,23 @@ def _make_timer_callbacks(uname, host, ctx):
     return on_overdue, on_unknown
 
 
+def _make_plugin_stale_callback(uname, ctx):
+    """Return an async callback that clears stale plugin data and its alerts."""
+    msg_to_websockets = ctx.get("msg_to_websockets")
+
+    async def on_plugin_stale(host, plugin_name):
+        host.plugin_data.pop(plugin_name, None)
+        stale_keys = [k for k in host.alert_states if k.startswith(f"{plugin_name}.")]
+        for k in stale_keys:
+            del host.alert_states[k]
+        eventlog(uname, "INFO", f"plugin data stale: {plugin_name}")
+        if msg_to_websockets:
+            msg_to_websockets("plugin_stale", {"host": uname, "plugin": plugin_name})
+            msg_to_websockets("host", host.stateinfo())
+
+    return on_plugin_stale
+
+
 def restore_connection_timers(hbdclass, ctx):
     """Restore overdue timers for all loaded connections after a pickle restore.
 
@@ -372,6 +389,10 @@ def handle_datagram(msg: dict, addr, transport, ctx: dict):
                            if k not in ("ID", "plugin", "id", "name")}
             # Store plugin data with timestamp
             host.add_plugin_data(plugin_name, plugin_data, timestamp=now)
+            # Reset stale timer — 3× the heartbeat interval (min 60 s)
+            stale_timeout = max(host.interval * 3, 60)
+            host.reset_plugin_timer(plugin_name, stale_timeout,
+                                    _make_plugin_stale_callback(uname, ctx))
 
             # If os_info reports an owner and none is configured server-side, apply it
             if plugin_name == "os_info":