fix(plugins): forgejo_error_reporter permissions korrekt auf Manifest-Ebene

Der vorherige Patch hatte permissions=["system:read"] versehentlich in die
PluginRouteDef-kwargs gesetzt statt auf Manifest-Ebene — der Key blieb
dadurch unregistriert (live bewiesen: nur 11/12 Keys im Produktionskatalog
sichtbar). Korrigiert; Test f9 prueft jetzt die ECHTEN Manifeste statt
manueller Registrierung, so haette der Fehler ab sofort gefangen werden
muessen.

Verifikation: tests/test_audit_architecture_fixes.py 17/17,
manifest.permissions=['system:read'], is_core=False, routes=1.

app/plugins/builtins/forgejo_error_reporter/plugin.py

@@ -29,19 +29,21 @@ class ForgejoErrorReporterPlugin(BasePlugin):
         dependencies=[],
         events=[],
         migrations=[],
-        permissions=[],
+        # Audit P1 (permission catalog): /status route requires system:read —
+        # the key must be grantable via the manifest.
+        permissions=["system:read"],
         routes=[
             PluginRouteDef(
                 path="/api/v1/forgejo-error-reporter",
                 module="app.plugins.builtins.forgejo_error_reporter.routes",
                 router_attr="router",
-        permissions=["system:read"],
+            ),
-    ),
         ],
 
         author="LeoCRM Team",
         min_app_version="1.0.0",
-        contract_version="1.0.0")
+        contract_version="1.0.0",
+    )
 
     def __init__(self) -> None:
         super().__init__()

tests/test_audit_architecture_fixes.py

@@ -344,11 +344,26 @@ def test_f9_all_audit_permission_keys_registered():
     )
 
     init_permission_registry(set())
+    # Register from the REAL manifests (not hand-picked lists) — this catches
+    # kwargs-level corruption like the bug where permissions=[...] had landed
+    # inside PluginRouteDef kwargs instead of the manifest level.
+    from app.plugins.builtins.forgejo_error_reporter.plugin import (
+        ForgejoErrorReporterPlugin,
+    )
+    from app.plugins.builtins.permissions.plugin import PermissionsPlugin
+
+    assert PermissionsPlugin().manifest.permissions == [
+        "permissions:read", "permissions:admin",
+    ]
+    assert ForgejoErrorReporterPlugin().manifest.permissions == ["system:read"], (
+        "system:read must be declared at MANIFEST level (not PluginRouteDef kwargs)"
+    )
+
     get_permission_registry().register_plugin_permissions(
-        "permissions", ["permissions:read", "permissions:admin"]
+        "permissions", PermissionsPlugin().manifest.permissions
     )
     get_permission_registry().register_plugin_permissions(
-        "forgejo_error_reporter", ["system:read"]
+        "forgejo_error_reporter", ForgejoErrorReporterPlugin().manifest.permissions
     )
 
     known = get_permission_registry().get_all()