feat: planSetup — guided-setup plan preview over the hub connection

Wraps the new HubAdmin.PlanSetup RPC (pure plan assembly, no state
change). Regenerated stubs from the updated proto.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/src/hub_client.dart

@@ -89,6 +89,7 @@ typedef CuratedModel = pb.CuratedModel;
 typedef ClearEventLogResponse = pb.ClearEventLogResponse;
 typedef DaemonPathsResponse = pb.DaemonPathsResponse;
 typedef AuthStatusResponse = pb.AuthStatusResponse;
+typedef PlanSetupResponse = pb.PlanSetupResponse;
 typedef AuthTokenInfo = pb.AuthTokenInfo;
 typedef JwtValidatorInfo = pb.JwtValidatorInfo;
 typedef UninstallModuleResponse = pb.UninstallModuleResponse;
@@ -303,6 +304,31 @@ class HubClient {
     return _admin.authStatus(Empty());
   }
 
+  /// Assemble the guided-setup plan for [scenario] / [intent] /
+  /// [target] (kebab-case wire values) — a pure computation on the
+  /// hub, no state change. Field-for-field what `chain init
+  /// --plan-json` prints, so GUIs can render the setup preview over
+  /// the existing connection instead of spawning the CLI.
+  Future<PlanSetupResponse> planSetup({
+    required String scenario,
+    required String intent,
+    required String target,
+    bool requireApproval = false,
+    bool dataMustStayLocal = false,
+    bool allowUnsignedModules = false,
+  }) {
+    return _admin.planSetup(
+      pb.PlanSetupRequest(
+        scenario: scenario,
+        intent: intent,
+        target: target,
+        requireApproval: requireApproval,
+        dataMustStayLocal: dataMustStayLocal,
+        allowUnsignedModules: allowUnsignedModules,
+      ),
+    );
+  }
+
   /// Server-streaming audit-log subscription. The hub first
   /// replays up to [backfill] historical events (oldest-last so
   /// the receiver sees them in chronological order), then keeps