feat(plugins): richer admin panel + registry detail view

Admin list: flush-left header like Addons, type/reviewed badges, runtime
health as a dot on the icon tile (text badge only for problem states),
description + source-repo link on installed cards, manifest icon.

Browse: cards show the plugin screenshot (docs/screenshot.png at the pinned
commit) and open a detail dialog fed by GET /api/admin/plugins/registry/:id —
live-manifest permissions in plain language, egress hosts, setup preview,
repo/homepage links. Manifest fetched server-side through safeDownload at the
reviewed commit, cached per plugin for 30 min and only when a detail opens.

Also fixes the update flow (restart the running child around the install,
keep the admin's enabled intent instead of force-activating disabled
plugins), guards the icon lookup against Object.prototype names, reserves
ids that would shadow static admin routes, stops negative-caching failed
manifest fetches, and makes the version compare prerelease-safe.

server/tests/unit/plugins/manifest.test.ts

@@ -34,6 +34,7 @@ describe('parseManifest', () => {
 
   it.each([
     ['Bad-Id', { ...base, id: 'Bad-Id' }, /invalid id/],
+    ['reserved id', { ...base, id: 'registry' }, /reserved id/],
     ['bad version', { ...base, version: '1.x' }, /invalid version/],
     ['bad type', { ...base, type: 'thing' }, /invalid type/],
     ['native', { ...base, nativeModules: true }, /native modules/],