test(cabana): Plugins screen endpoints

- TestPluginsEndpoints: 401/403/200 for both endpoints, the update rule
  table, cache hit and expiry on an injected clock, failure caching, at
  most 4 version lookups at once, call timeout, marketplace validation,
  markers, https-only icons, disabled registry making no call
- fix: marketplace categories come only from plugins the screen offers,
  not from registry entries dropped for an invalid ID
- check-phase34.sh: TestPluginsEndpoints and useSettings.test.ts required

modules/cabana/plugins.go

@@ -456,11 +456,15 @@ func (s *service) pluginsMarketplace(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, out)
 }
 
-// categoriesOf returns the distinct valid categories of plugins, sorted.
+// categoriesOf returns the distinct valid categories of the plugins the
+// marketplace offers (valid IDs only), sorted.
 func categoriesOf(plugins []kiosk.RegistryPlugin) []string {
 	seen := map[string]bool{}
 	out := []string{}
 	for _, p := range plugins {
+		if !marketplaceIDRe.MatchString(p.ID) {
+			continue
+		}
 		if p.Category != "" && marketplaceCategoryRe.MatchString(p.Category) && !seen[p.Category] {
 			seen[p.Category] = true
 			out = append(out, p.Category)