refactor(platform): split 981-line plugins.go into per-domain modules

[HongmingWang-Rabbit]

Summary

Pure mechanical split of platform/internal/handlers/plugins.go — no behavior changes, no test changes. Groups the PluginsHandler surface area by responsibility.

Before / after

File	Before	After	Contents
plugins.go	981	194	PluginsHandler struct, constructor, With* options, RuntimeLookup, pluginInfo + supportsRuntime, manifest parsing (parseManifestYAML, readPluginManifest, strDefault), container helpers (findRunningContainer, execInContainer/execAsRoot/execInContainerAs)
plugins_sources.go	—	14	ListSources (GET /plugins/sources)
plugins_listing.go	—	174	Read-only endpoints: ListRegistry, listRegistryFiltered, ListAvailableForWorkspace, ListInstalled, CheckRuntimeCompatibility
plugins_install.go	—	276	Route entrypoints for mutating ops: Install, Uninstall, Download
plugins_install_pipeline.go	—	368	Install pipeline: install-layer consts + env-var caps, httpErr + newHTTPErr, logInstallLimitsOnce, dirSize, validatePluginName, installRequest/stageResult, resolveAndStage, deliverToContainer, copyPluginToContainer, streamDirAsTar, readPluginSkillsFromContainer, stripPluginMarkersFromMemory, regexpEscapeForAwk

Function count preserved: 32 total (was 32 in original plugins.go).

Every file is under the 400-line soft cap; plugins.go hits the ≤200 target.

Judgment calls

• validatePluginName is used by every domain file; parked it in plugins_install_pipeline.go (alongside the other sanitization helpers) rather than plugins.go, purely to keep plugins.go under the 200-line target. Same-package, so callers don't care.
• Install/Uninstall/Download stay as full handler bodies in plugins_install.go (not thin wrappers in plugins.go) so the split is mechanical — moving a func (h *PluginsHandler) Foo() method between files in the same package is a no-op to callers.
• plugins_sources.go is tiny (14 lines, one handler) but kept as its own file per the grouping requested in the task.

Test plan

• cd platform && go build ./... — clean
• go vet ./... — clean
• go test -race ./internal/handlers/... — passes (cached ok)
• plugins_test.go untouched (1365 lines, 59 test funcs)
• No other handler files modified — diffstat is 5 files, all plugins*.go

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

7-Gate Verification — PASSED

1. CI — 6/6 green (pre-verified).
2. Checkout + build — go build ./... and go vet ./... clean on refactor/split-plugins-handler.
3. Comprehensive tests — go test -race -count=1 ./... all packages pass (handlers 4.03s fresh, no cache). tests/e2e/test_api.sh = 62/62 pass against live platform.
4. Security audit — diff grep for fmt.Sprintf w/ SQL verbs, new os.Getenv(, bearer/CanCommunicate bypass, sk-ant-/ghp_/AKIA, X-Workspace-ID tampering: all clean. Pure code motion, no new env vars, no new auth paths.
5. Design fit — Go backend refactor; no dialogs/CSS/PM-bypass/doc-link rules apply. Runtime-agnostic plugin filtering logic preserved verbatim in plugins_listing.go.
6. Line-level review — function count preserved: original plugins.go had 32 funcs; new split is plugins.go(11) + plugins_install.go(3) + plugins_install_pipeline.go(12) + plugins_listing.go(5) + plugins_sources.go(1) = 32. plugins_test.go untouched (0-line diff). Stat: 787 deletions / 832 insertions (delta = package-level doc comments on new files). No behavior change.
7. Manual UI test — N/A, backend-only refactor.

Pure file-split, no behavior change, no auth/billing/data-deletion surface. Safe to merge via merge-commit.