[FEATURE]: Python plugin backward compatibility with existing framework

[terylt]

Epic: CPEX Rust Core (#12)

Summary

Create cpex-hosts::python — a Rust-side adapter that lets the Rust PluginManager call existing Python plugins via PyO3. This is the "Rust → Python" direction — backward compatibility with the current Python plugin ecosystem.

Motivation

There is an existing base of Python CPEX plugins (identity resolver, token delegator, custom plugins). These need to run inside the Rust PluginManager without rewriting them in Rust. The Python host bridges the gap by implementing HookHandler<H> and delegating to the Python plugin's hook method via PyO3.

Scope

• PythonPluginAdapter — implements HookHandler<H> for any hook type
• Calls into Python via Python::with_gil() — wraps payload/extensions as PyO3 objects, calls the Python method, converts the result back
• Handles @hook decorator discovery — reads the Python plugin's registered hooks
• Error handling — Python exceptions converted to PluginError
• GIL management — Send + Sync safety for the adapter
• Plugin loading — instantiate Python plugin classes from module paths (kind: "python://module.Class")

Acceptance Criteria

• Existing Python plugins run inside the Rust PluginManager
• Python plugin's @hook decorators are respected for hook registration
• block(), allow(), modify() return values from Python are correctly converted to PluginResult
• Error in a Python plugin respects on_error behavior (Fail/Ignore/Disable)
• Payload modifications from Python plugins are accepted by the Rust merge logic

Dependencies

• Issue [FEATURE]: Python bindings (PyO3) #19 (Python bindings) — shares the PyO3 infrastructure

References

• cpex/framework/base.py (Python Plugin class, @hook decorator)