feat(website): marketplace section (third nav volume)

[GeekCmore]

Stacked on #7 (feat/plugin-market-command) — merge that first; this branch contains it.

What

The「插件市场 / Marketplace」section on may-fly.dev, as the third nav volume between the user and developer manuals, consuming the plugin index published by Ephemeral-AI-Lab/dsh-plugins (marketplace PR: Ephemeral-AI-Lab/dsh-plugins#8).

• Nav + sidebars (zh root + /en/): 插件市场 · Marketplace, with static 市场/收录 groups — listing growth never touches this repo.
• Six handwritten page pairs: catalog shell (<MarketCatalog/>), installing & updating (/plugin + dsh CLI, npm/GitHub sources, restart semantics, allowBuilds), trust & safety (three tiers, verified semantics, "listing ≠ sandbox"), submit (PR flow + authorization evidence), manifest spec (field tables), review checklist.
• scripts/generate-market.mjs wired into the website build script (runs in both the PR check and deploy): fetches dist/catalog.json, fails on unknown schemaVersion, falls back to the bundled snapshot with a loud warning while the marketplace repository has not shipped dist/ on main yet; generates /market/p/<id>/ detail pages (zh + en: badges, frontend-support verdict table, copyable install command, sanitized README excerpt) and the pruned catalog JSON for the component.
• MarketCatalog.vue: client-side search (id/displayName/双语描述/tools/commands) + surface & source filters over badge cards.
• website-pages.yml: repository_dispatch: [market-updated] (the marketplace repo's index-publish pings on rebuilds; set its MARKET_NOTIFY_TOKEN secret to a PAT with mayfly access) + a weekly safety-net schedule.
• Cross-links: /dsh/plugins heads to the market, /plugins/publishing tails to submit, the /plugin command rows now link /market/.

Verification

• pnpm --filter @ephemeral-ai/mayfly-website run build green locally: 14 plugin detail pages × zh/en generated from the marketplace PR's catalog, zero dead links (README excerpts sanitized: HTML stripped at Vue-compile safety, relative repo links degraded to labels, paragraph-boundary truncation).

Rollout

1. Merge feat(market): restructure as the Mayfly/DSH plugin marketplace dsh-plugins#8 (marketplace repo) — index-publish ships dist/ to its main.
2. Merge feat(interaction): /plugin marketplace command #7 (/plugin command).
3. Merge this PR — the site builds from live catalog data from then on (the bundled snapshot is only a pre-merge fallback).

🤖 Generated with Claude Code

[GeekCmore]

Follow-up hardening is now on this stacked PR, rebased onto the updated #7.

• English SSR catalog content and detail links now use VitePress locale data; dynamic links honor DOCS_BASE via withBase().
• Third-party README text is rendered inert (v-pre + HTML/interpolation escaping); catalog validation rejects unsafe ids and malformed install sources before generating files.
• Generated install commands include every row and shell-quote GitHub specs.
• Added repository tests covering path traversal, VitePress include/Vue interpolation/script payloads, unsafe links, malformed catalogs, and multi-row commands.

Verification: pnpm run verify:full and strict pnpm run website:build pass. Built HTML was checked for correct zh/en SSR descriptions and routes, including a non-root /review/ base. LAN preview remains available at http://192.168.8.188:4175/ for acceptance.

[GeekCmore]

ACP compatibility is now reflected by commit f738f46: the catalog labels it Automation, filters it separately from TUI/Web/Server, generates a dedicated-profile command, and warns that it owns stdio and must not be installed into Mayfly or dsh Web. The site was rebuilt from the now-live marketplace main/dist/catalog.json; the LAN preview at http://192.168.8.188:4175/ is updated.

[GeekCmore]

Acceptance completed

The marketplace website was reviewed from the dedicated PR preview and accepted together with the /plugin workflow.

Exercised routes:

• Chinese marketplace: http://192.168.8.188:4175/market/
• English marketplace: http://192.168.8.188:4175/en/market/

Merge preparation:

• dsh-plugins#8 is merged and its validation passed.
• PR feat(interaction): /plugin marketplace command #7 is merged first as required.
• This branch was rebased onto the resulting main; tree content stayed identical and the PR now contains only Website/market-generator changes.
• The post-rebase Website build check and full typecheck/lint/test/coverage check passed.