Issue #184: add safe project plugin uninstall

[NWYLZW]

Summary

Adds a safe, project-scoped uninstall flow for managed plugins while preserving the existing distinction between disabling a plugin at runtime and removing its managed installation.

Closes #184

Root cause and user impact

Plugin management previously exposed disable behavior, but uninstalling a project-managed plugin required coordinated updates across managed-plugin configuration, installed artifacts, discovery/runtime state, server APIs, and client state. Without a dedicated coordinated flow, users could not reliably remove one plugin while retaining its data or prove that sibling plugins and their data were untouched.

This change adds the coordinated uninstall service and route, managed-plugin removal/config updates, runtime refresh behavior, confirmation UI, marketplace/detail actions, localized copy, and focused coverage across the affected packages.

Implementation

• Add managed-plugin mutation/removal primitives and config update support.
• Add server-side marketplace uninstall orchestration and API routing.
• Refresh discovery/runtime state after confirmation so the removed target disappears.
• Add marketplace and detail-page uninstall actions with an explicit confirmation summary.
• Keep disable and uninstall as distinct operations.
• Cover retain/delete-data behavior and sibling-plugin preservation.

Current review status: REQUEST_CHANGES

This Draft PR is not a full PASS. The current review found the following items that still need follow-up:

• The uninstall/detail UI discloses absolute filesystem paths.
• Production behavior emits a 503 plugin-version-resolution console error.
• TypeScript validation reports four errors.
• The detail-action test's i18n mock is missing initReactI18next.
• Three isolated uninstall-service tests fail because of an incomplete managed-plugin mock and leaked state.
• The route-suite loopback rerun passed 5/5, but one bind attempt was blocked by the environment.

Observed passes

• Disable and uninstall remain distinct.
• Cancel receives default focus.
• The confirmation presents a semantic delete/retain summary.
• Confirm triggers refresh/navigation.
• The uninstall target disappears after confirmation.
• Sibling plugins and their data are preserved.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
oneworks-dev	Ready	Preview	Jul 30, 2026 5:59am

[github-actions]

Experience Review

Before merge, make sure the PR body contains this completed checklist:

## Experience Review
- [x] 已判断是否需要沉淀经验
- [x] 如需要，已运行 `$post-task-experience-review`
- [x] reviewer PASS 后才进入 merge

Checklist to confirm:

• Decide whether this PR produced reusable project experience.
• If experience should be captured, run $post-task-experience-review.
• Merge only after the independent reviewer reports PASS.