Allow plugins to override download directory via config

Adds downloadDir() method that checks for 'dest_dir' in plugin config before falling back to manifest destDir. The config value is validated against protected paths and normalized (leading slash added, trailing slashes removed). This allows plugin web cards to offer a configurable download destination setting.