feat(plugins): artifact integrity, deterministic lockfile, version helpers and trust badges

[Ayinkx01]

Summary

Implements four Phase 9 plugin-marketplace foundations, all branched from AyinkxLab/ai-code-assistant main (70005b1):

• Phase 9: Artifact integrity (sha256) verification #384 — Artifact integrity (sha256) verification. Adds app/services/plugin_artifacts.py: streams artifacts, normalizes catalog digests (sha256:, sha256-, bare hex), compares with hmac.compare_digest, records a bounded audit denial on mismatch, and exposes verify_and_register_artifact() so registration only happens after verification.
• Phase 9: Deterministic lockfile output #398 — Deterministic lockfile output. Adds app/services/plugin_lockfile.py: sorts entries by plugin id, canonicalizes PEP 440 versions, normalizes hashes to sha256:<lowercase hex>, sorts dependencies, writes sorted-key JSON with one trailing LF, omits volatile resolved_at, and supports atomic writes.
• Phase 9: PEP 440 version comparison utilities #399 — PEP 440 version comparison utilities. Adds app/services/plugin_versions.py with parse/validate/normalize/compare/sort/latest helpers and clear invalid-version errors. Compatibility (plugin_compat.py) and dependency (plugin_deps.py) checks now reuse it.
• Phase 9: Trust and compatibility badges UI #419 — Trust and compatibility badges UI. Adds app/static/js/plugin_badges.js, rendering trusted/unverified/invalid signature and compatible/incompatible/unknown states with visible text, icons, and aria-label (never color alone). The plugin management view loads it, and tests/js/plugin_badges.test.js asserts the rendered labels.

Verification

• python -m pytest tests/test_plugin_versions.py tests/test_plugin_compat.py tests/test_plugin_deps.py tests/test_plugin_lockfile.py tests/test_plugin_artifacts.py tests/test_plugins_api.py -q — pass
• python -m ruff check <changed Python files> — pass
• python -m black --check <changed Python files> — pass
• npm test — 54 tests pass

Manual checks also confirmed: PEP 440 ordering/sorting, byte-identical lockfile output for shuffled entries, sha256 match accepted and mismatch refused, and badge labels rendered as expected.

Closes #384
Closes #398
Closes #399
Closes #419

Baseline note: this PR includes a one-character fix for a syntax typo in tests/test_notifications.py (self/ app → self, app) that broke repo-wide ruff/black on main. Repo-wide ruff check . and black --check . are now green. The full pytest suite still has two pre-existing failures from merged PR #500, which imports a missing app.services.budget_alerts module; those are unrelated to this PR and all plugin suites are green.

[drips-wave]

@Ayinkx01 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits