bitcoin-wallet, extracted into plugins/bitcoin-wallet — the platform half

Tenth extraction, and the first where the blocker was a permission rather than
a path. The wallet was kind: 'admin' — owner only, never grantable — and plugin
permissions are always kind: 'app'. mount.ts forces that and the manifest has
no field for anything else, deliberately, so a plugin cannot ask to be
restricted. Extraction therefore could not preserve admin.

Raised before moving any code, because turning "the server owner's bitcoin"
into a row in the grants list beside Photos and Music is the kind of change
nobody notices until someone ticks it.

Made anyway, and the objection inverts: every wallet query is scoped by
user_id, taken from X-Officer-User which the platform injects from the session,
so granting the permission gives an account its OWN wallet rather than access
to anyone else's — including to the owner, whose bypass covers permission
checks and not query scoping. kind: 'admin' was single-user thinking.

Named bitcoin-wallet, not wallet: appName drives route, API prefix, table
prefix and install key together, so the name should say what it is. Tables are
bitcoin_wallet_*; the prefix guard normalises the hyphen. Verified free before
committing to it — no wallet table exists on any server, and db:push would
treat a rename as a drop plus a create.

registry.test.ts re-anchored: `wallet` was its canonical kind: 'admin' fixture
and its no-selfService fixture. Now user-admin/server-admin and terminal, with
a note that a plugin's permissions are always `app` — which is exactly why this
one needed a decision rather than a default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/plugins/marketplace.ts

@@ -212,6 +212,28 @@ const BUNDLED: CatalogueEntry[] = [
     // shows rather than the daemon behind it. See its PLUGIN.md for what that cost.
     has: { api: true, schema: true, sidecar: true, web: true },
   },
+  {
+    appName: 'bitcoin-wallet',
+    publisher: 'officerdev',
+    version: '1.0.0',
+    platform: '>=1.0.0',
+    label: 'Bitcoin Wallet',
+    summary: 'A self-custodial bitcoin wallet — keys sealed on the server, never on a device',
+    color: '#f7931a',
+    icon: 'Bitcoin',
+    source: 'https://gitea.officer.dev/plugins/bitcoin-wallet.git',
+    permissions: [
+      {
+        key: 'bitcoin-wallet',
+        label: 'Bitcoin Wallet',
+        description: "Bitcoin wallet — each account gets its own, sealed under that account's own passphrase",
+      },
+    ],
+    // Grantable, unlike the `kind: 'admin'` it had in the core registry — every query is scoped by
+    // user_id, so granting it gives an account its OWN wallet rather than access to anyone else's.
+    // See its PLUGIN.md; this was a deliberate decision, not a side effect of extraction.
+    has: { api: true, schema: true, sidecar: true, web: true },
+  },
   {
     appName: 'vault',
     publisher: 'officerdev',