Docs: marketplace, and clean up new-code warnings/lints

CLAUDE.md gets a Marketplace subsection under Key Conventions (the sync
script is app-embedded and re-uploaded on every sync, never baked into
container/ — pre-flight F9) and the Settings export/import section now
covers marketplace account tokens traveling in ExportedSecrets and the
import preview's warning on global hook and plugin installs.
HOW-TO-USE.md gets a Marketplace section (placed after Shared Claude
Authentication) with its Table of Contents entry (pre-flight N13). The
spec doc's stale keychain service name, gh-login flags and
upload_bytes_to_container signature are amended to match the shipped
code (pre-flight N10).

Also fixes the new marketplace code's remaining build/clippy warnings:
BTreeMap/Sha256/Digest imports in tree.rs gated behind #[cfg(test)]
(their only uses are on MemTree, already test-only), the unused
`pub use marketplace::*` glob re-export dropped from models/mod.rs,
gh_login::strip_ansi marked #[cfg(test)] (production streams through
AnsiStripper instead), and four clippy lints in marketplace test code
(double_ended_iterator_last, cloned_ref_to_slice_refs x2,
single_match). Flushes the unresolved getMarketplaceSyncReport promise
in MarketplaceSection.test.tsx's "opens the Marketplace filtered to
this project" test to remove its act() warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/src/components/projects/home/config/MarketplaceSection.test.tsx

@@ -77,8 +77,9 @@ describe("MarketplaceSection", () => {
     );
   });
 
-  it("opens the Marketplace filtered to this project", () => {
+  it("opens the Marketplace filtered to this project", async () => {
     render(<MarketplaceSection project={project} />);
+    await screen.findByText(/a file you created has the same name/);
     fireEvent.click(screen.getByRole("button", { name: "Open in Marketplace" }));
     expect(useAppState.getState().activeTabKey).toBe(MARKETPLACE_TAB_KEY);
     expect(useAppState.getState().marketplaceFilterProjectId).toBe("p1");