feat: enforce forced/managed plugins and policy. Split user upload permission

lib/admin/types.ts

@@ -24,6 +24,7 @@ export interface SettingRestriction {
 
 export interface FeatureGates {
   pluginsEnabled: boolean;
+  pluginsUploadEnabled: boolean;
   themesEnabled: boolean;
   sidebarAppsEnabled: boolean;
   userThemesEnabled: boolean;
@@ -40,6 +41,7 @@ export interface FeatureGates {
 
 export const DEFAULT_FEATURE_GATES: FeatureGates = {
   pluginsEnabled: true,
+  pluginsUploadEnabled: true,
   themesEnabled: true,
   sidebarAppsEnabled: true,
   userThemesEnabled: true,

lib/plugin-types.ts

@@ -73,6 +73,10 @@ export interface InstalledPlugin {
   enabled: boolean;
   status: PluginStatus;
   error?: string;
+  // True when plugin was delivered from server-side admin registry.
+  managed?: boolean;
+  // True when plugin is admin-enforced and cannot be disabled locally.
+  forceEnabled?: boolean;
   settingsSchema?: Record<string, SettingFieldSchema>;
   settings: Record<string, unknown>;
 }