fix: declare plugin service websocket authority

resources/plugin/templates/rust-component-instance/README.md

@@ -5,6 +5,6 @@ This template targets the Component Model-only runtime (`runtime.kind = "wasm-co
 It demonstrates both authoring surfaces supported by a shared Plugin instance:
 
 - `example_echo` is an ordinary request/response Tool handler.
-- `example_ws` is a Service ingress handler. The host owns WebSocket receive/reconnect work and dispatches bounded `websocket_text` events into `handle_ingress`. The guest replies by returning a `websocket_send` output command in `ServiceOutput`; do not run a guest-side `recv(timeout)` polling loop.
+- `example_ws` is a Service ingress handler. The host owns WebSocket receive/reconnect work and dispatches bounded `websocket_text` events into `handle_ingress`. The guest replies by returning a `websocket_send` output command in `ServiceOutput`; do not run a guest-side `recv(timeout)` polling loop. The manifest declares `host_api.websocket` plus a matching `[[websocket]]` target for the example URL. Enablement grants must explicitly allow the same WebSocket target before the host will send output commands.
 
 Build with `cargo component build --release` (or the project-specific build command used by your Plugin packaging flow), then run `yoi plugin check` / `yoi plugin pack` from the generated Plugin directory.

resources/plugin/templates/rust-component-instance/plugin.toml

@@ -11,6 +11,7 @@ permissions = [
   { kind = "service", name = "example_service" },
   { kind = "surface", surface = "ingress" },
   { kind = "ingress", name = "example_ws" },
+  { kind = "host_api", api = "websocket" },
 ]
 
 [runtime]
@@ -34,3 +35,8 @@ description = "Handles host-owned WebSocket text events and returns websocket_se
 event_kinds = ["websocket_text"]
 sources = ["websocket:wss://example.com/socket"]
 input_schema = { type = "object" }
+
+[[websocket]]
+scheme = "wss"
+host = "example.com"
+path_prefixes = ["/socket"]