feat(store): console plugin store, index repo, and the fixes on-glass found

Console: a Plugins section (Browse / Installed / Sources) on a static nav
entry, with install friction proportional to trust — a plain confirm for a
verified entry, a warning naming the curator for an external one, and a
danger dialog that makes you retype the spec for a raw package. Tier badges
are permanent and follow the plugin onto its own UI page.

Index: unom/punktfunk-plugin-index published and served from Gitea's raw
endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is
publish, which resolves the design's open hosting question.

Four things only running it could find:
- runner discovery matched @punktfunk/plugin-* only, so a third-party
  scoped plugin (which D8 requires) would install and never run
- ...and that convention also matches @punktfunk/plugin-kit, a plugin's
  own framework: it listed as installed and would have been imported as a
  unit. Both now key off the plugins dir's top-level dependencies, with an
  emptied dependency list meaning 'nothing installed' rather than falling
  back to the naming convention
- the store must not pass new flags to the runner: the scripting package
  ships separately and an older one reads an unknown flag's value as a
  package name. The host writes the bunfig scope mapping itself
- ureq reports only >= 400 as Err, so a conditional request's 304 arrives
  as Ok with an empty body — handled as an error it made every refresh
  after the first verify a signature over zero bytes and sit stale

Also: the console's first Tabs use exposed an @unom/ui theme gap that
rendered inactive tabs invisible (caught in a browser pass, not by types).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/src/sections/Plugins/index.tsx

@@ -8,9 +8,11 @@ import { getRouteApi, useNavigate } from "@tanstack/react-router";
 import { ExternalLink, RefreshCw } from "lucide-react";
 import { type FC, useEffect, useMemo, useRef } from "react";
 import { pluginIcon, usePlugins } from "@/api/plugins";
+import { useInstalledPlugins } from "@/api/store";
 import { Button } from "@/components/ui/button";
 import { useLocale } from "@/lib/i18n";
 import { m } from "@/paraglide/messages";
+import { TierBadge } from "@/sections/Store/TierBadge";
 
 const route = getRouteApi("/plugins/$pluginId/$");
 
@@ -26,6 +28,12 @@ export const SectionPlugin: FC = () => {
 	const Icon = pluginIcon(meta?.ui?.icon);
 	const title = meta?.title ?? pluginId;
 
+	// Provenance follows the plugin into its own page: an unverified plugin must stay visibly
+	// unverified WHILE you use it, not only in the store listing. The store keys installations by
+	// package, so the runtime id is matched through `plugin_id`.
+	const { data: installed } = useInstalledPlugins();
+	const provenance = installed?.find((p) => p.plugin_id === pluginId);
+
 	// Liveness: a 200 from /__health means the plugin is up. On failure we stop polling and show the
 	// offline card (the manual Retry re-probes).
 	const health = useQuery({
@@ -77,6 +85,7 @@ export const SectionPlugin: FC = () => {
 						v{meta.version}
 					</span>
 				)}
+				{provenance && <TierBadge tier={provenance.tier} />}
 				<a
 					href={`/plugin-ui/${pluginId}/`}
 					target="_blank"