docs(plugins): document traits in manifest schema; update RingCentral example to traits-first; add TODO to convert all examples

Author: Faxbot Agent

TODO.md

@@ -76,7 +76,12 @@ Purpose: While auditing AGENTS.md against the codebase and syncing the Admin Con
   - Show Tools → Plugins only when `FEATURE_V3_PLUGINS=true`; ensure no Plugin Builder routes or mentions remain in UI.
   - Validate curated registry parity with server `/plugin-registry`; ensure demo mocks mirror current curated entries.
   - Security passes: manifests respect allowed domains, timeouts, HTTPS in HIPAA; redact secrets in UI.
-  - Add redaction policy in manifest runtime to scrub sensitive fields from any UI‑surfaced debug output.
+- Add redaction policy in manifest runtime to scrub sensitive fields from any UI‑surfaced debug output.
+
+- Update example manifests to traits‑first
+  - Goal: all example manifests (faxplus, ringcentral, interfax, sfax, pamfax, dropbox_fax) include a top‑level `traits` block that aligns with `config/provider_traits.json` (kind, requires_ghostscript, requires_tiff, supports_inbound, inbound_verification, needs_storage, outbound_status_only).  
+  - Done: RingCentral example in docs uses traits‑first.  
+  - TODO: update remaining examples and add validation in dev‑kit to warn when `traits` is missing.
 
 - API Admin Actions & Terminal tests
   - Add tests for `GET /admin/actions` and `POST /admin/actions/run` (gating via `ENABLE_ADMIN_EXEC`, allowlist, backend gating, timeout). New file: `api/tests/test_admin_actions.py`.

docs/plugins/index.md

@@ -61,13 +61,22 @@ These example manifests live in the repo and can be used as starting points.
 - id `pamfax` — PamFax
 - id `dropbox_fax` — Dropbox Fax
 
-=== "RingCentral example"
+=== "RingCentral example (traits-first)"
 
 ```json
 {
   "id": "ringcentral",
   "name": "RingCentral Fax API",
   "auth": { "scheme": "bearer" },
+  "traits": {
+    "kind": "cloud",
+    "requires_ghostscript": true,
+    "requires_tiff": false,
+    "supports_inbound": false,
+    "inbound_verification": "none",
+    "needs_storage": false,
+    "outbound_status_only": false
+  },
   "actions": {
     "send_fax": {
       "method": "POST",

docs/plugins/manifest-http.md

@@ -33,6 +33,10 @@ Faxbot supports a lightweight outbound provider type defined by a JSON manifest.
 :material-key: `auth`
 : `{ scheme: none|basic|bearer|api_key_header|api_key_query, ... }`
 
+:material-shield-check: `traits`
+: Optional traits that describe runtime needs and behavior. Traits override defaults in `config/provider_traits.json`.  
+  Example keys: `kind` (`cloud`|`self_hosted`), `requires_ghostscript`, `requires_tiff`, `supports_inbound`, `inbound_verification` (`hmac`|`none`|`internal_secret`), `needs_storage`, `outbound_status_only`.
+
 :material-domain: `allowed_domains`
 : Array of hostnames