Build a global array with function pointers that are executed when the do/perfom functions are called in the core. The function pointers are added by plugins that are enabled. The execution points can be found here.

• Admin page that scans plugin folder looking for plugin-folders and some manifest file
• Manifest contains name, version, plugin main file (perhaps more strict like drupal? force naming?)
• Admin ui shows list of plugins (enabled/disable states)

• Checkbox and save plugin main file in database (if more strict, plugin name only?)

• When core execution finishes, do_action() and do_filter()

• Admin page that scans theme folder looking for manifest file

• Manifest contains info about name, type, version of theme

• User themes can differ from admin themes

• Store path to theme in database

• Fetch theme path from database

You can read about the menu system plan on this page