step 10 complete: plugin marketplace with catalog, review workflow, and revenue split

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

BACKEND_PLAN.md

@@ -356,20 +356,20 @@ adiuva-api/
 
 - **Outcome:** Secure, rate-limited API with prompt IP protection.
 
-### Step 10 — Plugin Marketplace
-- [ ] `app/marketplace/plugin_registry.py`:
+### Step 10 — Plugin Marketplace ✅
+- [x] `app/marketplace/plugin_registry.py`:
   - `PluginRegistry`:
     - `async list_plugins(category, query, page, sort) -> PluginListResponse`
     - `async get_plugin(plugin_id) -> PluginManifest | None`
     - `async submit_plugin(manifest: PluginManifest, package_s3_key: str) -> str` — returns plugin_id, sets status = 'pending_review'
     - `async approve_plugin(plugin_id) -> None` — admin only, sets status = 'approved'
     - `async reject_plugin(plugin_id, reason: str) -> None`
-- [ ] `app/marketplace/plugin_review.py`:
+- [x] `app/marketplace/plugin_review.py`:
   - `ReviewQueue`:
     - `async get_pending() -> list[dict]`
     - `async submit_review(plugin_id, reviewer_id, decision, notes) -> None`
   - Security checklist enforced before approval: manifest schema valid, permissions are from allowed set, no binary blobs in manifest
-- [ ] `app/marketplace/revenue_share.py`:
+- [x] `app/marketplace/revenue_share.py`:
   - `RevenueShare`:
     - `async record_install(plugin_id, user_id, amount_cents) -> None`
     - `async payout_developer(plugin_id, period) -> None` — Stripe Connect transfer: 70% to developer