v0.2.7 — Plugin boot order from package manifests

Plugin boot order now comes from each installed plugin's composer.json. Plugins can declare extra.naf.boot.before and extra.naf.boot.after without requiring the host to maintain a complete plugins.php list. Composer dependencies remain installation requirements and do not impose bootstrap order.

The framework validates the full graph before running any plugin bootstrap. It reports invalid metadata and cycles with their declaring packages, ignores absent optional targets, and uses package names for deterministic ties. A host plugins.php can still prioritize installed plugins when its order does not conflict with declared requirements. App::getPluginBootPlan() exposes the resulting order and reasons for diagnostics.

Regression coverage exercises ordering, malformed manifests, cycles, missing targets, host preferences, and a real application boot with configuration and route precedence.