feat: create manifest-driven plugin system for third-party extensions

[Musab1258]

Linked issue

Closes #411

What changed and why

This PR fully implements the third-party extension system (D-008), moving the dashboard from a lightweight internal module loader to a robust, manifest-driven plugin architecture.

Key additions include:

• Plugin Architecture & Loader: Replaced the legacy PluginManager with a new manifest-aware registry. It now supports both trusted module plugins and sandboxed iframe execution environments.
• Marketplace & UI: Created a fully functional plugin registry view (PluginRegistryView.tsx) within Settings. It allows users to browse a mocked marketplace, view extension details, and review required permissions before installation.
• Permissions System: Defined strict permission scopes (e.g., dashboard:read, notifications:write) enforced at runtime. Users are prompted to approve permissions prior to installation, and grants are persisted locally alongside installed plugins via pluginStorage.js.
• SDK & CLI Scaffold: Exported a public TypeScript SDK (src/plugins/sdk.ts) defining types and manifest builders. Added a developer CLI (scripts/create-plugin.mjs / npm run plugin:create) to instantly scaffold new module or iframe plugins.
• Documentation: Added architecture documentation and manifest examples in docs/plugins/README.md.
• Dependencies Fix: Downgraded the pinned @tensorflow/tfjs-node version to ^4.22.0 in package.json to resolve a legacy peer dependency conflict blocking npm install.

Test plan

• Tested the PluginManager core logic using vitest (src/plugins/__tests__/PluginManager.test.js) to ensure it properly installs manifests, exposes widgets, hydrates from localStorage, and uninstalls cleanly.
• Added window.matchMedia mocks to the test setup to ensure store initializations work correctly in the testing environment.
• Validated the UI by navigating to the "Extensions" tab in the dashboard Settings, browsing the mocked marketplace catalog, and executing install/uninstall/disable flows.
• Scaffolding a test extension using npm run plugin:create -- --name "Test Plugin" --id "org.test.plugin" --output ./test-plugin to verify the CLI script creates the correct boilerplate.
• Ran npm run type-check and npx eslint to fix all warnings and verify strict typing.

Breaking changes

Yes (describe below)

• Plugin Registration API: The underlying PluginManager and plugin registration APIs have been completely rewritten to expect Manifests rather than simple React component exports. Any existing internal plugins (e.g., runtimeStatusPlugin) have been updated to export proper version, permissions, and initialize configurations.
• UI Updates: The old status-list plugin registry UI has been fully replaced with the new Marketplace and Permission Review UI.

Notes for reviewers

• Marketplace Mock: The marketplace catalog (src/plugins/pluginCatalog.js) currently relies on a hardcoded array of mocked plugins (MARKETPLACE_PLUGINS) for demonstration. In the future, this can be easily wired up to a real backend endpoint.
• Dependency Fix: You may notice a change in package.json regarding @tensorflow/tfjs-node. The previous pin ^5.0.0 was causing an ETARGET error during npm install. I rolled it back to ^4.22.0 (the actual published tag) so the installation and test suites could run successfully.

[vercel]

@Musab1258 is attempting to deploy a commit to the nanle-code's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Musab1258 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits