The route I added returned 401 to an <a download>, which Chrome reports as "Try to sign in to the
site" — a plain navigation carries no Bearer token, so that advice cannot work. The platform publishes
extension/ to /plugins/browser/extension.zip instead, which is served without auth like plugin icons.
zip.ts moved to the platform: extensions are meant to be a marketplace of them, not this plugin's
private trick.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>