Marketplace: Tauri commands, store-owned fields and startup refresh

The 21 marketplace commands, registered and granted; marketplace fields
kept store-owned in update_settings/update_project; a background refresh
of every marketplace at app start.

- apply_marketplace_now emits marketplace-sync-finished per project (F4).
- Settings export carries marketplace account tokens in ExportedSecrets
  (account id -> token) and import restores them; imported accounts,
  marketplaces and global installs are validated with the commands' own
  rules before anything is written. The import preview discloses the
  marketplace count, token count and global hook installs, and warns on
  the latter (F10).
- refresh_pins and cache removal hold the repo lock (F11).
- ops::validate_host/validate_branch delegate to auth::valid_host and
  git::valid_branch (F13).
- A finished gh container login frees only its own cancel slot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/src-tauri/src/commands/project_commands.rs

@@ -1148,6 +1148,9 @@ fn restore_store_owned_fields(project: &mut Project, stored: &Project) {
     project.browser_view_enabled = stored.browser_view_enabled;
     project.auth_bridge_enabled = stored.auth_bridge_enabled;
     project.created_at = stored.created_at.clone();
+    // Owned by the marketplace commands; a Config-tab save carries a stale copy.
+    project.marketplace_installs = stored.marketplace_installs.clone();
+    project.marketplace_disabled = stored.marketplace_disabled.clone();
 }
 
 #[tauri::command]
@@ -2300,4 +2303,28 @@ mod tests {
         assert_eq!(payload.status, ProjectStatus::Running);
         assert_eq!(payload.created_at, stored.created_at);
     }
+
+    /// The marketplace commands own a project's installs and opt-outs; the
+    /// Config tab's next unrelated save carries a stale copy of both.
+    #[test]
+    fn a_stale_save_cannot_undo_a_marketplace_install() {
+        use crate::models::marketplace::{ItemKind, MarketplaceInstall, MarketplaceItemRef};
+        let (mut stored, mut payload) = stored_and_stale_payload();
+        stored.marketplace_installs = vec![MarketplaceInstall {
+            marketplace_id: "m1".into(),
+            kind: ItemKind::Agent,
+            key: "code-reviewer".into(),
+            commit: "a".repeat(40),
+        }];
+        stored.marketplace_disabled = vec![MarketplaceItemRef {
+            marketplace_id: "m1".into(),
+            kind: ItemKind::Hook,
+            key: "h".into(),
+        }];
+
+        restore_store_owned_fields(&mut payload, &stored);
+
+        assert_eq!(payload.marketplace_installs, stored.marketplace_installs);
+        assert_eq!(payload.marketplace_disabled, stored.marketplace_disabled);
+    }
 }