Add admin-configurable settings for marketplace

[kenny08gt]

What does this PR do?

Adds admin-configurable marketplace settings so site admins can define marketplace registry URLs from the EmDash admin UI instead of relying only on astro.config.

This PR introduces a new Settings → Marketplace screen that allows admins to:

• configure one or more marketplace registries,
• select the active registry,
• save marketplace settings in site settings,
• use the active registry for both plugin and theme marketplace flows.

Behavior is currently single active marketplace, but the stored settings shape is future-ready for multiple registries.

This PR also adds validation, UX clarification, and safety guidance:

• marketplace URLs must use HTTPS in production,
• http://localhost / 127.0.0.1 is only allowed for local development,
• the Marketplace settings screen includes a warning to use only official or trusted registries,
• the UI clearly explains that only the selected active registry is used.

Resolution precedence is now:

1. admin-configured marketplace setting
2. astro.config marketplace value
3. no marketplace configured

Closes #

Type of change

• Bug fix
• Feature (requires approved Discussion)
• Refactor (no behavior change)
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm --silent lint:json | jq '.diagnostics | length' returns 0
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: Allow changing the marketplace URL from admin settings #199

AI-generated code disclosure

• This PR includes AI-generated code

Screenshots / test output

Admin UI

• New route: /_emdash/admin/settings/marketplace
• New settings card under Settings
• Active marketplace selection is explicitly labeled in the UI
• Marketplace screen includes a safety warning for untrusted registries

Verification

• pnpm typecheck ✅
• pnpm --silent lint:json | jq '.diagnostics | length' ✅
• pnpm format ✅
• packages/admin browser tests ✅
• marketplace-related tests ✅

Notes

• Full pnpm test is still failing on unrelated existing auth test expectations in /Users/alanhurtarte/Projects/emdash/packages/core/tests/unit/auth/invite.test.ts, /Users/alanhurtarte/Projects/emdash/packages/core/tests/unit/auth/magic-link.test.ts, and /Users/alanhurtarte/Projects/emdash/packages/core/tests/unit/auth/signup.test.ts.

[github-actions]

Scope check

This PR changes 751 lines across 27 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 187191d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
emdash	Minor
@emdash-cms/admin	Minor
@emdash-cms/cloudflare	Patch
@emdash-cms/plugin-ai-moderation	Major
@emdash-cms/plugin-atproto	Patch
@emdash-cms/plugin-audit-log	Patch
@emdash-cms/plugin-color	Major
@emdash-cms/plugin-embeds	Major
@emdash-cms/plugin-forms	Major
@emdash-cms/plugin-webhook-notifier	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[kenny08gt]

I have read the CLA Document and I hereby sign the CLA

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat(admin): add Lingui i18n infrastructure #234 (5 shared files)
• feat(admin): add Taxonomy Types management page #213 (3 shared files)
• Fix taxonomy links missing from admin sidebar #93 (3 shared files)
• Store CSS classes, make editor toolbar extensible #143 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.

[BenjaminPrice]

There's a larger discussion around the future of Marketplace happening in #296 that's currently blocking moving forward on marketplace PRs. Feel free to jump into the conversation.