feat(store): console plugin store, index repo, and the fixes on-glass found

Console: a Plugins section (Browse / Installed / Sources) on a static nav
entry, with install friction proportional to trust — a plain confirm for a
verified entry, a warning naming the curator for an external one, and a
danger dialog that makes you retype the spec for a raw package. Tier badges
are permanent and follow the plugin onto its own UI page.

Index: unom/punktfunk-plugin-index published and served from Gitea's raw
endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is
publish, which resolves the design's open hosting question.

Four things only running it could find:
- runner discovery matched @punktfunk/plugin-* only, so a third-party
  scoped plugin (which D8 requires) would install and never run
- ...and that convention also matches @punktfunk/plugin-kit, a plugin's
  own framework: it listed as installed and would have been imported as a
  unit. Both now key off the plugins dir's top-level dependencies, with an
  emptied dependency list meaning 'nothing installed' rather than falling
  back to the naming convention
- the store must not pass new flags to the runner: the scripting package
  ships separately and an older one reads an unknown flag's value as a
  package name. The host writes the bunfig scope mapping itself
- ureq reports only >= 400 as Err, so a conditional request's 304 arrives
  as Ok with an empty body — handled as an error it made every refresh
  after the first verify a signature over zero bytes and sit stale

Also: the console's first Tabs use exposed an @unom/ui theme gap that
rendered inactive tabs invisible (caught in a browser pass, not by types).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/messages/de.json

@@ -267,5 +267,112 @@
 	"stats_delete_confirm": "Diese Aufnahme löschen? Das kann nicht rückgängig gemacht werden.",
 	"stats_detail_title": "Aufnahme-Details",
 	"stats_close": "Schließen",
-	"stats_no_samples": "Diese Aufnahme enthält keine Proben."
+	"stats_no_samples": "Diese Aufnahme enthält keine Proben.",
+	"store_title": "Plugins",
+	"store_subtitle": "Durchstöbere den Plugin-Katalog, installiere und entferne Plugins und lege fest, welchen Katalogen dieser Host vertraut.",
+	"store_tab_browse": "Entdecken",
+	"store_tab_installed": "Installiert",
+	"store_tab_sources": "Quellen",
+	"store_tier_verified": "Geprüft",
+	"store_tier_verified_hint": "Aus dem eingebauten unom-Katalog — unom hat genau dieses Paket geprüft.",
+	"store_tier_external": "Externe Quelle",
+	"store_tier_external_hint": "Festgepinnt und auf Integrität geprüft, aber von jemand anderem als unom kuratiert. Niemand bei unom hat diesen Code geprüft.",
+	"store_tier_unverified": "Ungeprüft",
+	"store_tier_unverified_hint": "Aus einer rohen Paketangabe installiert. Kein Katalog, keine Prüfung — diesen Code hat nie jemand kontrolliert.",
+	"store_tier_cli": "Über die CLI installiert",
+	"store_tier_cli_hint": "Von der Kommandozeile installiert — der Host weiß daher nicht, woher es stammt.",
+	"store_from_source": "von",
+	"store_search_placeholder": "Plugins durchsuchen…",
+	"store_filter_all": "Alle Quellen",
+	"store_empty": "Noch keine Plugins im Katalog.",
+	"store_no_match": "Kein Plugin passt zur Suche.",
+	"store_by_author": "von {author}",
+	"store_homepage": "Website",
+	"store_install": "Installieren",
+	"store_installed_label": "Installiert",
+	"store_update_to": "Auf {version} aktualisieren",
+	"store_incompatible": "Nicht kompatibel mit diesem Host.",
+	"store_blocked": "Vom Host blockiert: {reason}",
+	"store_spec_open": "Aus Paketangabe installieren…",
+	"store_runner_title": "Plugin-Runner",
+	"store_runner_help": "Der Dienst, in dem jedes Plugin läuft. Ihn abzuschalten stoppt alle Plugins auf einmal, ohne etwas zu deinstallieren.",
+	"store_runner_not_installed": "Der Plugin-Runner ist auf diesem Host nicht installiert — Plugins können daher nicht starten.",
+	"store_runner_banner": "Der Plugin-Runner ist ausgeschaltet — Plugins starten erst, wenn du ihn aktivierst.",
+	"store_runner_enable": "Runner aktivieren",
+	"store_runner_disable": "Runner deaktivieren",
+	"store_runner_state_running": "Läuft",
+	"store_runner_state_stopped": "Gestoppt",
+	"store_runner_state_disabled": "Deaktiviert",
+	"store_runner_state_missing": "Nicht installiert",
+	"store_runner_unit": "Dienst",
+	"store_runner_principal": "Läuft als",
+	"store_runner_failed": "Der Plugin-Runner konnte nicht umgeschaltet werden.",
+	"store_installed_title": "Installierte Plugins",
+	"store_installed_empty": "Noch keine Plugins installiert.",
+	"store_running": "Läuft",
+	"store_stopped": "Läuft nicht",
+	"store_uninstall": "Deinstallieren",
+	"store_uninstall_confirm": "{title} deinstallieren? Du kannst es jederzeit wieder aus dem Katalog installieren.",
+	"store_uninstall_failed": "Die Deinstallation konnte nicht gestartet werden.",
+	"store_update_no_entry": "Dieses Plugin steckt derzeit in keinem Katalog — aktualisiere die Quellen und versuche es erneut.",
+	"store_sources_title": "Katalogquellen",
+	"store_sources_help": "Wo dieser Host nach Plugins sucht. Der eingebaute unom-Katalog ist immer dabei; jede weitere Quelle hast du selbst hinzugefügt und stehst selbst dafür ein.",
+	"store_refresh_all": "Alle aktualisieren",
+	"store_refresh_failed": "Die Kataloge konnten nicht aktualisiert werden.",
+	"store_source_builtin": "Eingebaut",
+	"store_source_signed": "Signiert",
+	"store_source_unsigned": "Unsigniert",
+	"store_source_stale": "Veraltet",
+	"store_source_entries": "{count} Plugins",
+	"store_source_fetched": "zuletzt geladen {when}",
+	"store_source_never": "nie",
+	"store_source_remove": "Quelle entfernen",
+	"store_source_remove_confirm": "Die Quelle „{name}“ entfernen? Bereits daraus installierte Plugins bleiben installiert.",
+	"store_source_remove_failed": "Die Quelle konnte nicht entfernt werden.",
+	"store_source_builtin_locked": "Der eingebaute unom-Katalog kann nicht entfernt werden.",
+	"store_add_source_title": "Katalogquelle hinzufügen",
+	"store_field_source_name": "Name",
+	"store_field_source_url": "Index-URL",
+	"store_field_source_key": "Öffentlicher Schlüssel (optional)",
+	"store_field_source_key_help": "Ein ed25519:…-Schlüssel. Ist er gesetzt, akzeptiert der Host von dieser Quelle nur einen signierten Index.",
+	"store_add_source": "Quelle hinzufügen",
+	"store_add_source_failed": "Die Quelle konnte nicht gespeichert werden — prüfe Name und URL.",
+	"store_source_trust_title": "Dieser Quelle vertrauen?",
+	"store_source_trust_body": "Alles, was du aus „{name}“ installierst, ist Code, den unom nicht geprüft hat. Er läuft auf diesem Host mit den Rechten des Plugin-Runners. Füge nur einen Katalog hinzu, dessen Betreiber du vertraust.",
+	"store_source_trust_unsigned": "Ohne öffentlichen Schlüssel kann der Host nicht erkennen, ob dieser Index unterwegs manipuliert wurde.",
+	"store_source_trust_confirm": "Verstanden — Quelle hinzufügen",
+	"store_install_title": "{title} installieren?",
+	"store_install_verified_body": "Version {version} aus dem eingebauten unom-Katalog. unom hat genau dieses Paket geprüft.",
+	"store_install_confirm": "Installieren",
+	"store_install_external_title": "{title} aus einer externen Quelle installieren?",
+	"store_install_external_body": "Version {version} stammt aus „{source}“ — einem Katalog, den du selbst hinzugefügt hast.",
+	"store_install_external_note": "unom hat diesen Code nicht geprüft. Das Paket ist festgepinnt und auf Integrität geprüft, läuft auf diesem Host aber mit den Rechten des Plugin-Runners.",
+	"store_install_external_confirm": "Trotzdem installieren",
+	"store_install_failed": "Die Installation konnte nicht gestartet werden.",
+	"store_busy": "Der Host installiert oder entfernt gerade schon ein Plugin. Versuche es, sobald das durch ist.",
+	"store_spec_title": "Aus einer Paketangabe installieren",
+	"store_spec_lead": "Das installiert Code direkt aus einer Paket-Registry. Er steht in keinem Katalog, niemand hat ihn geprüft, und er läuft auf diesem Host mit den Rechten des Plugin-Runners — mit demselben Zugriff auf deine Dateien und deine Sitzung.",
+	"store_spec_permanent": "Ein so installiertes Plugin bleibt als „Ungeprüft“ markiert, solange es installiert ist.",
+	"store_spec_field": "Paketangabe",
+	"store_spec_field_help": "Zum Beispiel @scope/plugin-name@1.2.3.",
+	"store_spec_confirm_field": "Gib die Paketangabe zur Bestätigung erneut ein",
+	"store_spec_checkbox": "Mir ist klar, dass hier ungeprüfter Code mit Betreiberrechten ausgeführt wird.",
+	"store_spec_confirm": "Ungeprüft installieren",
+	"store_job_install": "{target} wird installiert",
+	"store_job_uninstall": "{target} wird entfernt",
+	"store_job_done_install": "Installiert.",
+	"store_job_done_uninstall": "Entfernt.",
+	"store_job_failed": "Der Vorgang ist fehlgeschlagen.",
+	"store_job_restarting": "Der Plugin-Runner startet neu — die Seitenleiste zieht gleich nach.",
+	"store_job_log": "Log anzeigen",
+	"store_job_dismiss": "Ausblenden",
+	"store_phase_queued": "In der Warteschlange",
+	"store_phase_verifying": "Paket wird verifiziert",
+	"store_phase_installing": "Wird installiert",
+	"store_phase_removing": "Wird entfernt",
+	"store_phase_checking": "Installation wird geprüft",
+	"store_phase_rolling_back": "Wird zurückgerollt",
+	"store_phase_recording": "Herkunft wird vermerkt",
+	"store_phase_restarting": "Plugin-Runner startet neu",
+	"store_phase_done": "Fertig"
 }

web/messages/en.json

@@ -267,5 +267,112 @@
 	"stats_delete_confirm": "Delete this recording? This can't be undone.",
 	"stats_detail_title": "Recording detail",
 	"stats_close": "Close",
-	"stats_no_samples": "This recording has no samples."
+	"stats_no_samples": "This recording has no samples.",
+	"store_title": "Plugins",
+	"store_subtitle": "Browse the plugin catalog, install and remove plugins, and choose which catalogs this host trusts.",
+	"store_tab_browse": "Browse",
+	"store_tab_installed": "Installed",
+	"store_tab_sources": "Sources",
+	"store_tier_verified": "Verified",
+	"store_tier_verified_hint": "From the built-in unom catalog — unom reviewed this exact package.",
+	"store_tier_external": "External source",
+	"store_tier_external_hint": "Pinned and integrity-checked, but curated by someone other than unom. Nobody at unom reviewed this code.",
+	"store_tier_unverified": "Unverified",
+	"store_tier_unverified_hint": "Installed from a raw package spec. No catalog, no review — nobody checked this code.",
+	"store_tier_cli": "Installed via CLI",
+	"store_tier_cli_hint": "Installed from the command line, so the host has no record of where it came from.",
+	"store_from_source": "from",
+	"store_search_placeholder": "Search plugins…",
+	"store_filter_all": "All sources",
+	"store_empty": "No plugins in the catalog yet.",
+	"store_no_match": "No plugin matches your search.",
+	"store_by_author": "by {author}",
+	"store_homepage": "Homepage",
+	"store_install": "Install",
+	"store_installed_label": "Installed",
+	"store_update_to": "Update to {version}",
+	"store_incompatible": "Not compatible with this host.",
+	"store_blocked": "Blocked by the host: {reason}",
+	"store_spec_open": "Install from package spec…",
+	"store_runner_title": "Plugin runner",
+	"store_runner_help": "The service every plugin runs inside. Disabling it stops all plugins at once without uninstalling anything.",
+	"store_runner_not_installed": "The plugin runner isn't installed on this host, so plugins can't start.",
+	"store_runner_banner": "The plugin runner is switched off — plugins won't start until you enable it.",
+	"store_runner_enable": "Enable runner",
+	"store_runner_disable": "Disable runner",
+	"store_runner_state_running": "Running",
+	"store_runner_state_stopped": "Stopped",
+	"store_runner_state_disabled": "Disabled",
+	"store_runner_state_missing": "Not installed",
+	"store_runner_unit": "Service",
+	"store_runner_principal": "Runs as",
+	"store_runner_failed": "Could not change the plugin runner.",
+	"store_installed_title": "Installed plugins",
+	"store_installed_empty": "No plugins installed yet.",
+	"store_running": "Running",
+	"store_stopped": "Not running",
+	"store_uninstall": "Uninstall",
+	"store_uninstall_confirm": "Uninstall {title}? You can install it again from the catalog.",
+	"store_uninstall_failed": "Could not start the removal.",
+	"store_update_no_entry": "That plugin isn't in any catalog right now — refresh the sources and try again.",
+	"store_sources_title": "Catalog sources",
+	"store_sources_help": "Where this host looks for plugins. The built-in unom catalog is always present; every other source is one you added and vouch for yourself.",
+	"store_refresh_all": "Refresh all",
+	"store_refresh_failed": "Could not refresh the catalogs.",
+	"store_source_builtin": "Built in",
+	"store_source_signed": "Signed",
+	"store_source_unsigned": "Unsigned",
+	"store_source_stale": "Out of date",
+	"store_source_entries": "{count} plugins",
+	"store_source_fetched": "last fetched {when}",
+	"store_source_never": "never",
+	"store_source_remove": "Remove source",
+	"store_source_remove_confirm": "Remove the source “{name}”? Plugins already installed from it stay installed.",
+	"store_source_remove_failed": "Could not remove the source.",
+	"store_source_builtin_locked": "The built-in unom catalog can't be removed.",
+	"store_add_source_title": "Add a catalog source",
+	"store_field_source_name": "Name",
+	"store_field_source_url": "Index URL",
+	"store_field_source_key": "Public key (optional)",
+	"store_field_source_key_help": "An ed25519:… key. With a key set, the host only accepts a signed index from this source.",
+	"store_add_source": "Add source",
+	"store_add_source_failed": "Could not save the source — check the name and the URL.",
+	"store_source_trust_title": "Trust this source?",
+	"store_source_trust_body": "Everything you install from “{name}” is code unom has not reviewed. It runs on this host with the plugin runner's privileges. Only add a catalog whose operator you trust.",
+	"store_source_trust_unsigned": "Without a public key the host can't tell whether this index was tampered with in transit.",
+	"store_source_trust_confirm": "I understand — add the source",
+	"store_install_title": "Install {title}?",
+	"store_install_verified_body": "Version {version} from the built-in unom catalog. unom reviewed this exact package.",
+	"store_install_confirm": "Install",
+	"store_install_external_title": "Install {title} from an external source?",
+	"store_install_external_body": "Version {version} comes from “{source}”, a catalog you added yourself.",
+	"store_install_external_note": "unom has not reviewed this code. The package is pinned and integrity-checked, but it will run on this host with the plugin runner's privileges.",
+	"store_install_external_confirm": "Install anyway",
+	"store_install_failed": "Could not start the install.",
+	"store_busy": "The host is already installing or removing a plugin. Try again once it's finished.",
+	"store_spec_title": "Install from a package spec",
+	"store_spec_lead": "This installs code straight from a package registry. It is in no catalog, nobody has reviewed it, and it will run on this host with the plugin runner's privileges — the same access it has to your files and your session.",
+	"store_spec_permanent": "A plugin installed this way stays marked Unverified for as long as it is installed.",
+	"store_spec_field": "Package spec",
+	"store_spec_field_help": "For example @scope/plugin-name@1.2.3.",
+	"store_spec_confirm_field": "Type the package spec again to confirm",
+	"store_spec_checkbox": "I understand that this runs unreviewed code with operator privileges.",
+	"store_spec_confirm": "Install unverified",
+	"store_job_install": "Installing {target}",
+	"store_job_uninstall": "Removing {target}",
+	"store_job_done_install": "Installed.",
+	"store_job_done_uninstall": "Removed.",
+	"store_job_failed": "The job failed.",
+	"store_job_restarting": "The plugin runner is restarting — the sidebar catches up in a moment.",
+	"store_job_log": "Show log",
+	"store_job_dismiss": "Dismiss",
+	"store_phase_queued": "Queued",
+	"store_phase_verifying": "Verifying the package",
+	"store_phase_installing": "Installing",
+	"store_phase_removing": "Removing",
+	"store_phase_checking": "Checking the install",
+	"store_phase_rolling_back": "Rolling back",
+	"store_phase_recording": "Recording provenance",
+	"store_phase_restarting": "Restarting the plugin runner",
+	"store_phase_done": "Done"
 }