the extension download is a published file, not an authed route

The route I added returned 401 to an <a download>, which Chrome reports as "Try to sign in to the
site" — a plain navigation carries no Bearer token, so that advice cannot work. The platform publishes
extension/ to /plugins/browser/extension.zip instead, which is served without auth like plugin icons.

zip.ts moved to the platform: extensions are meant to be a marketplace of them, not this plugin's
private trick.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/PairingPanel.tsx

@@ -5,9 +5,11 @@ import { useState } from 'react';
 // pairing, calling /browser/relay-token, which worked only because the plugin happened to serve that
 // path. Same coupling the extraction removed everywhere else, and the last piece of it.
 //
-// The download link changed with it: it pointed at a static zip in the platform's public/ that nothing
-// regenerated and that was 58 lines behind the source. It now asks the plugin, which builds the archive
-// from the extension directory per request.
+// The download link changed with it. It pointed at a static zip in the platform's public/ that nothing
+// regenerated and that was 58 lines behind the source. The installer now builds it from this plugin's
+// `extension/` directory and publishes it to /plugins/browser/extension.zip, which is served WITHOUT
+// authentication — deliberately. An `<a download>` is a plain navigation carrying no Bearer token, so an
+// authenticated URL makes Chrome say "Try to sign in to the site", which is advice that cannot work.
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { Copy, Check, Download, ExternalLink, RefreshCw, Trash2 } from 'lucide-react';
 import { toast } from 'sonner';
@@ -97,7 +99,7 @@ export const PairingPanel = () => {
           Download and unzip the extension, then load it in Chrome:
         </p>
         <a
-          href="/api/browser/extension.zip"
+          href="/plugins/browser/extension.zip"
           download
           className="flex items-center justify-center gap-2 w-full h-11 rounded-md border border-duck-dark/15 dark:border-foreground/15 text-sm font-medium hover:bg-duck-dark/5 dark:hover:bg-foreground/5 transition-colors"
         >