[type:refactor] externalize Casdoor to plugin-store - #7500

Review: externalize Casdoor to plugin-store

Externalizing the Casdoor runtime plugin + Spring Boot starter to the plugin-store repo is the right direction and this PR executes it cleanly. I verified the build-critical pieces rather than assuming:

What is correct

• No dangling compile references. Searching the default branch for the removed artifact (shenyu-spring-boot-starter-plugin-casdoor) and the removed classes (CasdoorPlugin, CasdoorConfig, CasdoorPluginDateHandler) returns 0 references. Both reactor poms correctly drop the shenyu-plugin-casdoor module and the bootstrap/starter poms drop the dependency.
• Compatibility contract is preserved. PluginEnum.CASDOOR (40, "casdoor") is intentionally kept at head, and EnumServiceImpl now filters it out of the admin pluginEnums list via pluginEnum != PluginEnum.CASDOOR. The new docs/plugin-store-casdoor.md documents this explicitly (same plugin name/order/fields, and the downstream headers name/id/organization that the former in-tree CasdoorPlugin.handleToken injected — confirmed against the deleted source).
• Five production SQL dialects are correctly cleaned. mysql, ob, og, oracle, pg each delete the casdoor plugin row (id 39), all 6 plugin_handle rows, the permission/resource rows, and the namespace_plugin_rel row (1801816010882822176), consistently.
• License / SDK cleanup is consistent. casdoor-java-sdk 1.9.0 is removed from the root pom.xml property, the bootstrap-dist LICENSE, and the deleted module pom.

Issues

1. [MUST-FIX before merge — shenyu-admin/src/main/resources/sql-script/h2/schema.sql] The h2 schema deletes only one of the six casdoor plugin_handle rows (the endpoint/1570590990341775360 row) and leaves five orphaned rows (client_id, client_secrect, certificate, organization-name, application-name, all plugin_id = '39') behind. The plugin row for id 39 is gone, so these rows reference a plugin that no longer exists in that schema. Every other dialect (mysql/ob/og/oracle/pg) removes all six. h2 is the embedded/dev/admin-test database, so this is the one schema that admin actually boots against in dev/test — leaving stale plugin_handle rows will surface casdoor config fields in the admin UI/API for a plugin that isn't shipped. Please delete the remaining five rows so h2 matches the other five dialects.

2. [INFRA — not a regression] The CI is red, but the failures are broad and span entirely unrelated plugins — ShenyuClientPathControllerTest, SentinelPluginTest, ParamMappingPluginTest, CachePluginTest, Resilience4JPluginTest, CryptorRequestPluginTest, JwtPluginTest, plus the cross-cutting e2e-* and shenyu-integrated-test-* suites. None of these touch Casdoor (an authentication plugin), and the identical set failed on the sibling Hystrix externalization PR #7499 with The operation was canceled. This is the current CI-infrastructure instability, not a code regression from this PR. Recommend re-running the suite before merge, but it should not block review.

3. [NON-BLOCKING follow-up] The historical website plugin docs still present Casdoor as a built-in plugin. That cleanup belongs to the plugin-store repo's migration scope (same as Hystrix), so it is out of scope here — just flagging for tracking.

Verdict: Approved. The only change I ask for before merge is the h2 plugin_handle cleanup in item 1; everything else is consistent and correct. Great work keeping the compat contract and migration doc in place.