feat: add controlled plugin marketplace lifecycle

scripts/install-local.sh

@@ -17,6 +17,10 @@ usage() {
   PLUGIN_ETC_DIR         环境文件目录，默认 /etc/sub2api-add
   PLUGIN_VAR_DIR         插件数据目录，默认 /var/lib/sub2api-add
   PLUGIN_SYSTEM_USER     systemd 用户，默认 sub2api-plugin
+  PLUGIN_MARKETPLACE_INDEX
+                         plugin-admin 市场索引（默认数据目录下的 marketplace/index.json）
+  PLUGIN_MARKETPLACE_ALLOWED_HOSTS
+                         远程市场索引/插件包允许的精确主机列表
 EOF
 }
 
@@ -85,6 +89,10 @@ install_one() {
 
   if [[ "$name" == plugin-admin ]]; then
     ensure_env_value "$env_file" PLUGIN_REGISTRY_DIR "$data_dir"
+    install -d -m 0700 "$data_dir/marketplace"
+    if [[ ! -f "$data_dir/marketplace/index.json" && -f "$source/marketplace/index.example.json" ]]; then
+      install -m 0600 "$source/marketplace/index.example.json" "$data_dir/marketplace/index.json"
+    fi
     if grep -q '^PLUGIN_CONFIG_KEY=generate-and-replace-with-a-random-32-byte-secret$' "$env_file" ||
        ! grep -q '^PLUGIN_CONFIG_KEY=.' "$env_file"; then
       ensure_env_value "$env_file" PLUGIN_CONFIG_KEY "$(random_secret)"