the plugins screen becomes /marketplace

`/plugins` redirects rather than 404s: the word is in the dock, in the docs and in
whatever anyone bookmarked, and a route that worked yesterday returning nothing
reads as the feature having been removed. The API keeps its name — only the screen
moved — so the permission entry lists both paths, because a client-side redirect
is still a route that has to resolve before it can send anyone anywhere.

Also: the fetch stubs in marketplace.test.ts needed `as unknown as typeof fetch`.
Bun's `typeof fetch` carries `preconnect`, so a bare stub is not assignable —
tests passed while tsgo did not, which is the wrong way round to find out.

tsgo clean, frontend builds, 873 pass / 7 fail unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/permissions/registry.ts

@@ -385,7 +385,9 @@ const CORE_REGISTRY: Permission[] = [
     // `offscale` at read without being able to install or remove anything.
     kind: 'admin',
     api: ['/plugins'],
-    routes: ['/plugins'],
+    // The API kept its name; only the screen was renamed. `/plugins` stays listed because the redirect
+    // is a real route — a client-side redirect still has to resolve before it can send anyone anywhere.
+    routes: ['/marketplace', '/plugins'],
   },
   {
     key: 'server-admin',