feat(store): console plugin store, index repo, and the fixes on-glass found

Console: a Plugins section (Browse / Installed / Sources) on a static nav
entry, with install friction proportional to trust — a plain confirm for a
verified entry, a warning naming the curator for an external one, and a
danger dialog that makes you retype the spec for a raw package. Tier badges
are permanent and follow the plugin onto its own UI page.

Index: unom/punktfunk-plugin-index published and served from Gitea's raw
endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is
publish, which resolves the design's open hosting question.

Four things only running it could find:
- runner discovery matched @punktfunk/plugin-* only, so a third-party
  scoped plugin (which D8 requires) would install and never run
- ...and that convention also matches @punktfunk/plugin-kit, a plugin's
  own framework: it listed as installed and would have been imported as a
  unit. Both now key off the plugins dir's top-level dependencies, with an
  emptied dependency list meaning 'nothing installed' rather than falling
  back to the naming convention
- the store must not pass new flags to the runner: the scripting package
  ships separately and an older one reads an unknown flag's value as a
  package name. The host writes the bunfig scope mapping itself
- ureq reports only >= 400 as Err, so a conditional request's 304 arrives
  as Ok with an empty body — handled as an error it made every refresh
  after the first verify a signature over zero bytes and sit stale

Also: the console's first Tabs use exposed an @unom/ui theme gap that
rendered inactive tabs invisible (caught in a browser pass, not by types).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/messages/en.json

@@ -267,5 +267,112 @@
 	"stats_delete_confirm": "Delete this recording? This can't be undone.",
 	"stats_detail_title": "Recording detail",
 	"stats_close": "Close",
-	"stats_no_samples": "This recording has no samples."
+	"stats_no_samples": "This recording has no samples.",
+	"store_title": "Plugins",
+	"store_subtitle": "Browse the plugin catalog, install and remove plugins, and choose which catalogs this host trusts.",
+	"store_tab_browse": "Browse",
+	"store_tab_installed": "Installed",
+	"store_tab_sources": "Sources",
+	"store_tier_verified": "Verified",
+	"store_tier_verified_hint": "From the built-in unom catalog — unom reviewed this exact package.",
+	"store_tier_external": "External source",
+	"store_tier_external_hint": "Pinned and integrity-checked, but curated by someone other than unom. Nobody at unom reviewed this code.",
+	"store_tier_unverified": "Unverified",
+	"store_tier_unverified_hint": "Installed from a raw package spec. No catalog, no review — nobody checked this code.",
+	"store_tier_cli": "Installed via CLI",
+	"store_tier_cli_hint": "Installed from the command line, so the host has no record of where it came from.",
+	"store_from_source": "from",
+	"store_search_placeholder": "Search plugins…",
+	"store_filter_all": "All sources",
+	"store_empty": "No plugins in the catalog yet.",
+	"store_no_match": "No plugin matches your search.",
+	"store_by_author": "by {author}",
+	"store_homepage": "Homepage",
+	"store_install": "Install",
+	"store_installed_label": "Installed",
+	"store_update_to": "Update to {version}",
+	"store_incompatible": "Not compatible with this host.",
+	"store_blocked": "Blocked by the host: {reason}",
+	"store_spec_open": "Install from package spec…",
+	"store_runner_title": "Plugin runner",
+	"store_runner_help": "The service every plugin runs inside. Disabling it stops all plugins at once without uninstalling anything.",
+	"store_runner_not_installed": "The plugin runner isn't installed on this host, so plugins can't start.",
+	"store_runner_banner": "The plugin runner is switched off — plugins won't start until you enable it.",
+	"store_runner_enable": "Enable runner",
+	"store_runner_disable": "Disable runner",
+	"store_runner_state_running": "Running",
+	"store_runner_state_stopped": "Stopped",
+	"store_runner_state_disabled": "Disabled",
+	"store_runner_state_missing": "Not installed",
+	"store_runner_unit": "Service",
+	"store_runner_principal": "Runs as",
+	"store_runner_failed": "Could not change the plugin runner.",
+	"store_installed_title": "Installed plugins",
+	"store_installed_empty": "No plugins installed yet.",
+	"store_running": "Running",
+	"store_stopped": "Not running",
+	"store_uninstall": "Uninstall",
+	"store_uninstall_confirm": "Uninstall {title}? You can install it again from the catalog.",
+	"store_uninstall_failed": "Could not start the removal.",
+	"store_update_no_entry": "That plugin isn't in any catalog right now — refresh the sources and try again.",
+	"store_sources_title": "Catalog sources",
+	"store_sources_help": "Where this host looks for plugins. The built-in unom catalog is always present; every other source is one you added and vouch for yourself.",
+	"store_refresh_all": "Refresh all",
+	"store_refresh_failed": "Could not refresh the catalogs.",
+	"store_source_builtin": "Built in",
+	"store_source_signed": "Signed",
+	"store_source_unsigned": "Unsigned",
+	"store_source_stale": "Out of date",
+	"store_source_entries": "{count} plugins",
+	"store_source_fetched": "last fetched {when}",
+	"store_source_never": "never",
+	"store_source_remove": "Remove source",
+	"store_source_remove_confirm": "Remove the source “{name}”? Plugins already installed from it stay installed.",
+	"store_source_remove_failed": "Could not remove the source.",
+	"store_source_builtin_locked": "The built-in unom catalog can't be removed.",
+	"store_add_source_title": "Add a catalog source",
+	"store_field_source_name": "Name",
+	"store_field_source_url": "Index URL",
+	"store_field_source_key": "Public key (optional)",
+	"store_field_source_key_help": "An ed25519:… key. With a key set, the host only accepts a signed index from this source.",
+	"store_add_source": "Add source",
+	"store_add_source_failed": "Could not save the source — check the name and the URL.",
+	"store_source_trust_title": "Trust this source?",
+	"store_source_trust_body": "Everything you install from “{name}” is code unom has not reviewed. It runs on this host with the plugin runner's privileges. Only add a catalog whose operator you trust.",
+	"store_source_trust_unsigned": "Without a public key the host can't tell whether this index was tampered with in transit.",
+	"store_source_trust_confirm": "I understand — add the source",
+	"store_install_title": "Install {title}?",
+	"store_install_verified_body": "Version {version} from the built-in unom catalog. unom reviewed this exact package.",
+	"store_install_confirm": "Install",
+	"store_install_external_title": "Install {title} from an external source?",
+	"store_install_external_body": "Version {version} comes from “{source}”, a catalog you added yourself.",
+	"store_install_external_note": "unom has not reviewed this code. The package is pinned and integrity-checked, but it will run on this host with the plugin runner's privileges.",
+	"store_install_external_confirm": "Install anyway",
+	"store_install_failed": "Could not start the install.",
+	"store_busy": "The host is already installing or removing a plugin. Try again once it's finished.",
+	"store_spec_title": "Install from a package spec",
+	"store_spec_lead": "This installs code straight from a package registry. It is in no catalog, nobody has reviewed it, and it will run on this host with the plugin runner's privileges — the same access it has to your files and your session.",
+	"store_spec_permanent": "A plugin installed this way stays marked Unverified for as long as it is installed.",
+	"store_spec_field": "Package spec",
+	"store_spec_field_help": "For example @scope/plugin-name@1.2.3.",
+	"store_spec_confirm_field": "Type the package spec again to confirm",
+	"store_spec_checkbox": "I understand that this runs unreviewed code with operator privileges.",
+	"store_spec_confirm": "Install unverified",
+	"store_job_install": "Installing {target}",
+	"store_job_uninstall": "Removing {target}",
+	"store_job_done_install": "Installed.",
+	"store_job_done_uninstall": "Removed.",
+	"store_job_failed": "The job failed.",
+	"store_job_restarting": "The plugin runner is restarting — the sidebar catches up in a moment.",
+	"store_job_log": "Show log",
+	"store_job_dismiss": "Dismiss",
+	"store_phase_queued": "Queued",
+	"store_phase_verifying": "Verifying the package",
+	"store_phase_installing": "Installing",
+	"store_phase_removing": "Removing",
+	"store_phase_checking": "Checking the install",
+	"store_phase_rolling_back": "Rolling back",
+	"store_phase_recording": "Recording provenance",
+	"store_phase_restarting": "Restarting the plugin runner",
+	"store_phase_done": "Done"
 }