Add plugin builder for one-file client install

plugin/make-plugin.{sh,ps1} stamp a user's own Freshservice API key and the
shared server token into a template and emit a personalized freshservice.plugin
(direct HTTP MCP connection — no Node/mcp-remote/config editing on clients).
Built plugins embed credentials, so *.plugin is git-ignored; the committed
template holds only placeholders. Validated with 'claude plugin validate'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugin/README.md

@@ -0,0 +1,46 @@
+# Freshservice plugin builder
+
+Generates a personalized **`freshservice.plugin`** that connects Claude
+Desktop / Cowork to the shared Freshservice MCP server on the LAN — no Node.js,
+no `mcp-remote`, no hand-editing `claude_desktop_config.json`. The plugin uses
+a direct HTTP MCP connection with your own identity headers, so everything you
+do in Freshservice is attributed to **you**.
+
+## For coworkers: get connected in three steps
+
+1. **Get your Freshservice API key**: Freshservice → profile picture →
+   *Profile settings* → API key. Also ask IT (Spencer) for the **shared server
+   token**.
+
+2. **Build your plugin** (from a clone of this repo):
+
+   macOS / Linux:
+   ```bash
+   cd plugin && ./make-plugin.sh
+   ```
+
+   Windows (PowerShell):
+   ```powershell
+   cd plugin
+   powershell -ExecutionPolicy Bypass -File .\make-plugin.ps1
+   ```
+
+   Enter your API key and the shared token when prompted. This produces
+   `freshservice.plugin` **containing your key — don't share the file.**
+
+3. **Install it**: in Claude Desktop, go to Cowork → **Customize** → add the
+   `.plugin` file. Start a new chat; the Freshservice tools are available.
+
+## Requirements
+
+- Agent account in the PESCO Freshservice instance
+- Network reach to `192.168.101.12:3839` (on-site or VPN)
+
+## Notes
+
+- Defaults (server URL, domain) can be overridden via env vars:
+  `SERVER_URL=... FS_DOMAIN=... ./make-plugin.sh`
+- Built `.plugin` files are git-ignored on purpose — they embed credentials.
+- The server side of this lives in [`../mcp-server/`](../mcp-server/); it must
+  be running in multi-user mode (no `FRESHSERVICE_*` env baked in) for
+  per-user identity to be enforced.