feat(app): install and configure first-party plugins through the UI

[crs48]

Problem

In Settings → Plugins → Browse, every tier: bundled registry entry was labelled Built-in — including the 15 first-party connectors/actions (GitHub, Slack, Notion, Linear, Discord, Stripe, …) that are flagged autoInstalled: false and never actually install. The label lied, those entries had no Install button (in the list or the details view), and there was no way to configure any plugin.

What this does

Truthful labels — partitionListings now groups by actual install state: a bundled entry shows as Built-in only when the plugin registry really has it. Anything not installed appears under Available with a working Install button.

Real install through the UI — a new app-side catalog (first-party-catalog.ts) maps each non-auto-installed registry entry to an installable pure-data manifest whose capability grant mirrors the real defineConnector / defineAction / hub-feature declarations (secrets, network hosts, schema writes). Installs run through the normal registry.install at builtin provenance and persist across reloads via loadFromStore. Cards and the details view surface the requested access from the catalog.

Configuration through the UI — each catalog entry declares a config spec (tokens, webhook secrets, repo/base ids, …). The new generic PluginConfigDialog renders it (password inputs for secrets) and persists values device-only in localStorage (plugin-config.ts) — secrets never sync. Wired everywhere:

• Installing a configurable plugin drops straight into its config form
• The plugin details view gains a Configure button + amber Needs setup hint until required fields are set
• The Installed tab gets a gear button per configurable plugin and the same needs-setup hint
• Uninstall clears the saved config

Drift guard — first-party-catalog.test.ts (sibling of first-party-registry.test.ts) asserts every autoInstalled:false registry entry has a catalog record (stays installable) and every secret config field is covered by the declared capabilities.secrets.

Verification

• Typecheck passes; 24 tests pass (new catalog + config-store suites, updated partition tests, existing registry drift guard).
• Exercised end-to-end in the browser against the real 19-entry registry.json:
  • Browse shows 4 genuinely-installed plugins under Built in, 15 installable under Available
  • GitHub: details → Install → auto-opened config form → saved token/owner/repo → moved to Built in, no warning
  • Discord: installed without configuring → Needs setup hint in details + Installed tab
  • Full page reload: both stay installed, config persists, needs-setup state correct; no console errors

Note: apps/web is a private app — no changeset; changelog fragment included.

🤖 Generated with Claude Code

[github-actions]

✓ Changelog fragment found — thanks!

[github-actions]

🖼️ UI changes in this PR

No visual differences detected in the changed UI.

_{CI run}

[github-actions]

Preview removed for PR #447.