fix(arch-003): active-manifests available to every authenticated user

app/routes/plugins.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
 from app.deps import require_admin, require_permission
+from app.deps import get_current_user
 from app.plugins.migration_runner import MigrationValidationError
 from app.services.plugin_service import get_plugin_service
 
@@ -94,7 +95,10 @@ async def check_plugin_updates(
 @router.get("/active-manifests")
 async def get_active_manifests(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("plugins:read")),
+    # ARCH-003 fix: every authenticated user needs the UI manifests for the
+    # dynamic sidebar/routes — the data is pure UI metadata; actual data
+    # access stays protected by each endpoint's own permission.
+    current_user: dict = Depends(get_current_user),
 ):
     """Get UI manifests for all active plugins.