feat: add privileged same-origin plugin tier + crypto API surface

proxy.ts

@@ -75,10 +75,17 @@ export async function proxy(request: NextRequest) {
   const nonce = crypto.randomUUID();
   const isDev = process.env.NODE_ENV === "development";
   // The plugin-sandbox iframe document needs `'unsafe-eval'` to run plugin
-  // bundles via `new Function`. It is null-origin (sandbox="allow-scripts"),
-  // so the relaxation is scoped strictly to that document and never reaches
-  // the main app, plus it must be embeddable from `'self'`.
-  const isSandboxPath = pathname === "/plugin-sandbox" || pathname.startsWith("/plugin-sandbox/");
+  // bundles via `new Function`. The untrusted route is null-origin
+  // (sandbox="allow-scripts"); the privileged route is same-origin
+  // (allow-same-origin) so a vetted plugin gets real WebCrypto + IndexedDB.
+  // Both get the SAME CSP relaxations (unsafe-eval, frame-ancestors 'self');
+  // the privileged route's extra power comes from the iframe sandbox flag the
+  // host sets, gated by signature + admin approval, NOT from a wider CSP.
+  const isSandboxPath =
+    pathname === "/plugin-sandbox" ||
+    pathname.startsWith("/plugin-sandbox/") ||
+    pathname === "/plugin-sandbox-privileged" ||
+    pathname.startsWith("/plugin-sandbox-privileged/");
 
   const scriptSrc = isSandboxPath
     ? `'self' 'nonce-${nonce}' 'unsafe-eval'`