fix(plugins): stop mutating shared router objects in create_app()

Plugin route registration in main.py was mutating module-level router
singletons by appending require_active_plugin dependencies directly to
router.routes. This persisted across app instances, causing test routes
to inherit require_active_plugin checks and return 403 "plugin inactive"
when tests created their own FastAPI apps with those routers.

Fix: use app.include_router(router, dependencies=[plugin_dep]) which
adds dependencies at the app level without modifying the shared router.

Fixes 35 test failures across 4 test files:
- test_agent_memory.py (6 failures)
- test_external_agent_api.py (15 failures)
- test_graph_rag.py (7 failures)
- test_marketplace.py (7 failures)

app/main.py

@@ -497,23 +497,15 @@ def create_app() -> FastAPI:
                             router = getattr(router_module, route_def.router_attr)
                             # Check if this route definition is public (no auth required)
                             is_public = getattr(route_def, "is_public", False)
-                            from starlette.routing import WebSocketRoute
                             if is_public:
                                 # Public routes: no auth dependency, no plugin check
                                 app.include_router(router)
                                 logger.info(f"Registered PUBLIC routes for {plugin_name}: {route_def.module}")
                                 continue
                             plugin_dep = Depends(require_active_plugin(plugin_name))
-                            for route in router.routes:
-                                if isinstance(route, WebSocketRoute):
-                                    if not hasattr(route, 'dependencies'):
-                                        route.dependencies = []
-                                    route.dependencies.append(plugin_dep)
-                                    continue
-                                if not hasattr(route, 'dependencies'):
-                                    route.dependencies = []
-                                route.dependencies.append(plugin_dep)
-                            app.include_router(router)
+                            # Use include_router with dependencies to avoid mutating
+                            # the shared module-level router object (which tests reuse)
+                            app.include_router(router, dependencies=[plugin_dep])
                         except Exception as exc:
                             logger.error(f"Failed to register route {route_def.module}.{route_def.router_attr}: {exc}")
                     break