chore: wire through plugin policies + category from marketplace.json (#14305)

wire plugin marketplace metadata through app-server endpoints:
- `plugin/list` has `installPolicy` and `authPolicy`
- `plugin/install` has plugin-level `authPolicy`

`plugin/install` also now enforces `NOT_AVAILABLE` `installPolicy` when
installing.


added tests.

codex-rs/app-server-protocol/schema/json/v2/PluginInstallResponse.json

@@ -28,6 +28,13 @@
         "name"
       ],
       "type": "object"
+    },
+    "PluginAuthPolicy": {
+      "enum": [
+        "ON_INSTALL",
+        "ON_USE"
+      ],
+      "type": "string"
     }
   },
   "properties": {
@@ -36,6 +43,16 @@
         "$ref": "#/definitions/AppSummary"
       },
       "type": "array"
+    },
+    "authPolicy": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/PluginAuthPolicy"
+        },
+        {
+          "type": "null"
+        }
+      ]
     }
   },
   "required": [