feat(c4,arch-006): plugin route renderer enforces manifest permission via protected route

frontend/src/components/plugins/PluginRouteRenderer.tsx

@@ -2,6 +2,7 @@ import { useMemo } from 'react';
 import { useLocation } from 'react-router-dom';
 import { Loader2 } from 'lucide-react';
 import { usePluginStore } from '@/store/pluginStore';
+import { ProtectedRoute } from '@/components/common/ProtectedRoute';
 import { PluginPage } from './PluginLoader';
 
 /**
@@ -43,12 +44,20 @@ export function PluginRouteRenderer() {
     );
     const pluginName = plugin?.display_name || plugin?.name || matchedRoute.path;
 
-    return (
+    const page = (
       <PluginPage
         component={matchedRoute.component}
         pluginName={pluginName}
       />
     );
+
+    // ARCH-006: enforce the manifest permission like the static routes do.
+    // Empty permission = any authenticated user (route is already inside the
+    // protected route group).
+    if (matchedRoute.permission) {
+      return <ProtectedRoute permission={matchedRoute.permission}>{page}</ProtectedRoute>;
+    }
+    return page;
   }
 
   // If manifests haven't loaded yet, show a spinner (not null/blank)

frontend/src/store/pluginStore.ts

@@ -17,6 +17,7 @@ export interface PluginPageRoute {
   parent: string;
   protected: boolean;
   order: number;
+  permission?: string;
 }
 
 export interface PluginDetailTab {