fix: stream plugin RPC stdout live and preserve Traefik templates

[joecorall]

This addresses two unrelated paper cuts in the plugin RPC path and the Traefik bot-mitigation config rewriter.

Live plugin stdout

Plugin RPC reserves process stdout for the JSON response envelope, so long-running commands like sitectl create produced no visible progress until the plugin exited. This adds an opt-in LiveStdout execution option (driven by the SITECTL_RPC_LIVE_STDOUT=1 env var) that mirrors command stdout to the plugin process stderr while still capturing it into RPCResponse.Output. The host enables it for create so progress streams live; the buffered output is then suppressed to avoid duplicate printing.

• cmd/create.go: enable LiveStdout and skip re-printing captured output
• pkg/plugin/sdk.go: add CommandExecOptions.LiveStdout, plumb the env var, and route the plugin stderr sink when either live flag is set
• pkg/plugin/rpc_command.go: mirror command stdout to stderr in the plugin when SITECTL_RPC_LIVE_STDOUT=1

Traefik template-safe YAML rewrite

The bot-mitigation rewriter loaded the router config through a YAML parser to inject middleware. Traefik router files embed Go template scalars such as {{ env "DOMAIN" }}, which are not valid bare YAML and broke the load. This quotes unquoted {{ ... }} scalar values before parsing and leaves already-quoted values untouched, so the templates survive the round-trip.

• pkg/services/traefik/bot_mitigation.go: add quoteTraefikTemplateScalars / singleQuoteYAMLScalar and run them before LoadYAMLDocument