feat(store): console plugin store, index repo, and the fixes on-glass found

Console: a Plugins section (Browse / Installed / Sources) on a static nav
entry, with install friction proportional to trust — a plain confirm for a
verified entry, a warning naming the curator for an external one, and a
danger dialog that makes you retype the spec for a raw package. Tier badges
are permanent and follow the plugin onto its own UI page.

Index: unom/punktfunk-plugin-index published and served from Gitea's raw
endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is
publish, which resolves the design's open hosting question.

Four things only running it could find:
- runner discovery matched @punktfunk/plugin-* only, so a third-party
  scoped plugin (which D8 requires) would install and never run
- ...and that convention also matches @punktfunk/plugin-kit, a plugin's
  own framework: it listed as installed and would have been imported as a
  unit. Both now key off the plugins dir's top-level dependencies, with an
  emptied dependency list meaning 'nothing installed' rather than falling
  back to the naming convention
- the store must not pass new flags to the runner: the scripting package
  ships separately and an older one reads an unknown flag's value as a
  package name. The host writes the bunfig scope mapping itself
- ureq reports only >= 400 as Err, so a conditional request's 304 arrives
  as Ok with an empty body — handled as an error it made every refresh
  after the first verify a signature over zero bytes and sit stale

Also: the console's first Tabs use exposed an @unom/ui theme gap that
rendered inactive tabs invisible (caught in a browser pass, not by types).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/store/manifest.rs

@@ -193,7 +193,7 @@ mod tests {
         assert_eq!(r.tier, Tier::Verified);
         assert_eq!(r.version.as_deref(), Some("0.2.1"));
         // A package we never recorded has no entry — the caller reports it as CLI-installed.
-        assert!(m.get("punktfunk-plugin-other").is_none());
+        assert!(!m.contains_key("punktfunk-plugin-other"));
     }
 
     #[test]
@@ -211,8 +211,8 @@ mod tests {
         record(dir.path(), "@x/z", rec(Tier::External)).unwrap();
         forget(dir.path(), "@x/y").unwrap();
         let m = load(dir.path());
-        assert!(m.get("@x/y").is_none());
-        assert!(m.get("@x/z").is_some());
+        assert!(!m.contains_key("@x/y"));
+        assert!(m.contains_key("@x/z"));
         forget(dir.path(), "@not/here").unwrap(); // no-op, no error
     }
 
@@ -241,6 +241,6 @@ mod tests {
         assert_eq!(&s[4..5], "-");
         assert_eq!(&s[10..11], "T");
         // A known epoch value, to catch the civil-date arithmetic drifting.
-        assert!(s > "2026-01-01T00:00:00Z".to_string(), "{s}");
+        assert!(s.as_str() > "2026-01-01T00:00:00Z", "{s}");
     }
 }