feat(plugins): sell khanegi plugins as priced subscriptions

Catalog prices, purchase requests, and setting-key activation live on SuperAdmin so module admins can buy add-ons. Also rewrite legacy nerkh logo hosts to the SuperAdmin upload origin.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/plugins/plugin-store.controller.ts

@@ -0,0 +1,64 @@
+import { Body, Controller, Get, Param, Patch, Post, Query, UseGuards } from '@nestjs/common';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { PermissionsGuard } from '../auth/permissions.guard';
+import { RequirePermissions } from '../auth/permissions.decorator';
+import { CurrentUser } from '../auth/current-user.decorator';
+import {
+  ApprovePurchaseDto,
+  CreateCatalogSettingDto,
+  SaveCatalogItemDto,
+} from './dto/plugin-store.dto';
+import { PluginStoreService } from './plugin-store.service';
+
+@Controller('plugins/store')
+@UseGuards(JwtAuthGuard, PermissionsGuard)
+export class PluginStoreController {
+  constructor(private readonly store: PluginStoreService) {}
+
+  @Get('catalog')
+  @RequirePermissions('plugins:read')
+  catalog() {
+    return this.store.listCatalogAdmin();
+  }
+
+  @Patch('catalog/:id')
+  @RequirePermissions('plugins:write')
+  saveItem(
+    @Param('id') id: string,
+    @Body() dto: SaveCatalogItemDto,
+    @CurrentUser() user: { id: string },
+  ) {
+    return this.store.saveCatalogItem(id, dto, user.id);
+  }
+
+  @Post('catalog')
+  @RequirePermissions('plugins:write')
+  createSetting(
+    @Body() dto: CreateCatalogSettingDto,
+    @CurrentUser() user: { id: string },
+  ) {
+    return this.store.createCatalogSetting(dto, user.id);
+  }
+
+  @Get('requests')
+  @RequirePermissions('plugins:read')
+  requests(@Query('status') status?: string) {
+    return this.store.listRequestsAdmin(status);
+  }
+
+  @Post('requests/:id/approve')
+  @RequirePermissions('plugins:write')
+  approve(
+    @Param('id') id: string,
+    @Body() dto: ApprovePurchaseDto,
+    @CurrentUser() user: { id: string },
+  ) {
+    return this.store.approveRequest(id, dto, user.id);
+  }
+
+  @Post('requests/:id/reject')
+  @RequirePermissions('plugins:write')
+  reject(@Param('id') id: string, @CurrentUser() user: { id: string }) {
+    return this.store.rejectRequest(id, user.id);
+  }
+}