fix: marketplace detail, SSRF transport, ledger tests and workspace pricing

[Olajumoke-05]

Summary

One combined PR addressing four Phase 9/10 issues:

• Phase 9: Marketplace plugin detail page #417 Marketplace plugin detail page - adds an owner/member-aware detail view showing trust, compatibility, dependencies, declared/granted capabilities, source and artifact hash. Owners get install/update/enable/disable/uninstall controls; members are read-only. Catalog installs now persist their artifact digest in the workspace lockfile so the detail page can show it.
• Phase 9: Marketplace SSRF and transport tests #422 Marketplace SSRF and transport tests - adds offline mocked-transport coverage for allowlist refusal, https-only enforcement, redirect refusal (redirects are now refused outright, not merely not followed), timeout selection and declared/chunked response size caps.
• Phase 10: Usage ledger service unit tests #437 Usage ledger service tests - adds offline tests for normalization, scoping, recording, explicit/derived totals, aggregation, query listing, workspace-priced costs, backfill edge cases and invalid arguments. Also makes backfill idempotent per source message via a stable sentinel so identical counts/timestamps are not collapsed.
• Phase 10: Per-workspace price overrides #442 Per-workspace price overrides - adds a workspace_price_overrides model + migration, owner-scoped CRUD service, owner-only pricing API, and effective-price lookup/estimate helpers. Workspace overrides take precedence over global exact/wildcard prices, with global fallback when no override exists; ledger cost estimates use the workspace override when present.

Verification

• ruff check .
• black --check .
• python scripts/check_assets.py
• Targeted pytest suites for pricing, usage ledger, plugin network, plugin API/detail, workspace pricing API, marketplace E2E, lock entries/lockfile and migrations all pass.

Closes #417
Closes #422
Closes #437
Closes #442

[drips-wave]

@Olajumoke-05 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits