fix(server): expose active V2 plugin metadata

Allow the read-only OpenCode /api/plugin endpoint through the workspace proxy so the status panel can distinguish active plugins from configured but unloaded packages.

Keep the route inside the explicit proxy allowlist and cover it with the instance proxy suite. The focused 25-test proxy suite, server typecheck, and diff check pass.

packages/server/src/server/__tests__/instance-proxy.test.ts

@@ -132,6 +132,13 @@ describe("instance proxy location enforcement", () => {
     assert.match(JSON.parse(response.body).url, /^\/api\/model\/default\?/)
   })
 
+  it("allows active plugin metadata", async () => {
+    const { app } = await harness()
+    const response = await app.inject({ method: "GET", url: "/workspaces/workspace/instance/api/plugin" })
+    assert.equal(response.statusCode, 200)
+    assert.match(JSON.parse(response.body).url, /^\/api\/plugin\?/)
+  })
+
   it("allows ownership-scoped agent fallback lookups", async () => {
     const { app } = await harness()
     const response = await app.inject({ method: "GET", url: "/workspaces/workspace/instance/api/agent/build" })

packages/server/src/server/http-server.ts

@@ -895,7 +895,7 @@ function hasDotSegment(value: string): boolean {
 function isAllowedInstanceApiRoute(method: string, pathname: string): boolean {
   const route = pathname.replace(/\/+$/, "")
   const allowed: Array<[string, RegExp]> = [
-    ["GET", /^\/api\/(?:agent|command|config|integration|mcp|model|provider)$/],
+    ["GET", /^\/api\/(?:agent|command|config|integration|mcp|model|plugin|provider)$/],
     ["GET", /^\/api\/agent\/[^/]+$/],
     ["GET", /^\/api\/model\/default$/],
     ["GET", /^\/api\/(?:permission|question)\/request$/],