Add admin-configurable settings for marketplace

[kenny08gt]

What does this PR do?

Adds admin-configurable marketplace settings so site admins can define marketplace registry URLs from the EmDash admin UI instead of relying only on astro.config.

This PR introduces a new Settings → Marketplace screen that allows admins to:

• configure one or more marketplace registries,
• select the active registry,
• save marketplace settings in site settings,
• use the active registry for both plugin and theme marketplace flows.

Behavior is currently single active marketplace, but the stored settings shape is future-ready for multiple registries.

This PR also adds validation, UX clarification, and safety guidance:

• marketplace URLs must use HTTPS in production,
• http://localhost / 127.0.0.1 is only allowed for local development,
• the Marketplace settings screen includes a warning to use only official or trusted registries,
• the UI clearly explains that only the selected active registry is used.

Resolution precedence is now:

1. admin-configured marketplace setting
2. astro.config marketplace value
3. no marketplace configured

Closes #

Type of change

• Bug fix
• Feature (requires approved Discussion)
• Refactor (no behavior change)
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm --silent lint:json | jq '.diagnostics | length' returns 0
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: Allow changing the marketplace URL from admin settings #199

AI-generated code disclosure

• This PR includes AI-generated code

Screenshots / test output

Admin UI

• New route: /_emdash/admin/settings/marketplace
• New settings card under Settings
• Active marketplace selection is explicitly labeled in the UI
• Marketplace screen includes a safety warning for untrusted registries

Verification

• pnpm typecheck ✅
• pnpm --silent lint:json | jq '.diagnostics | length' ✅
• pnpm format ✅
• packages/admin browser tests ✅
• marketplace-related tests ✅

Notes

• Full pnpm test is still failing on unrelated existing auth test expectations in /Users/alanhurtarte/Projects/emdash/packages/core/tests/unit/auth/invite.test.ts, /Users/alanhurtarte/Projects/emdash/packages/core/tests/unit/auth/magic-link.test.ts, and /Users/alanhurtarte/Projects/emdash/packages/core/tests/unit/auth/signup.test.ts.

[github-actions]

Scope check

This PR changes 751 lines across 27 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 64f90d1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[kenny08gt]

I have read the CLA Document and I hereby sign the CLA

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat(admin): add Lingui i18n infrastructure #234 (5 shared files)
• feat(admin): add Taxonomy Types management page #213 (3 shared files)
• Fix taxonomy links missing from admin sidebar #93 (3 shared files)
• Store CSS classes, make editor toolbar extensible #143 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.

[BenjaminPrice]

There's a larger discussion around the future of Marketplace happening in #296 that's currently blocking moving forward on marketplace PRs. Feel free to jump into the conversation.

[ascorbic]

Hey. As @BenjaminPrice said, there's a discussion on how marketplaces will work, so I'm holding off on any related PRs at the moment

[kenny08gt]

No worries at all, makes total sense to wait for #296 to settle first. Feel free to close this if it doesn't fit the direction. Happy to revisit once the marketplace discussion lands.