feat(plugin): admin-configurable marketplace URL as the install default

The Settings install command had a <your-scribe-repo> placeholder — not
copyable. Add an instance-global 'plugin_marketplace_url' setting (admin sets
it to the app's own repo) that every user's MCP Access reads, so the
/plugin marketplace add command is copyable out of the box. Keeps it universal
(each deployment configures its own repo) rather than hardcoding one.

- services/settings.get_admin_setting(key): admin-scoped global read.
- routes/plugin: GET /api/plugin/marketplace-url (any user) + PUT (admin).
- SettingsView: Admin → 'Plugin marketplace' field to set it; MCP Access
  marketplace field falls back to the configured value.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/scribe/routes/plugin.py

@@ -10,11 +10,17 @@ from __future__ import annotations
 
 from quart import Blueprint, g, jsonify, request
 
-from scribe.auth import login_required
+from scribe.auth import admin_required, get_current_user_id, login_required
 from scribe.services import plugin_context as plugin_ctx_svc
+from scribe.services.settings import get_admin_setting, set_setting
 
 plugin_bp = Blueprint("plugin", __name__, url_prefix="/api/plugin")
 
+# Setting key for the git URL of the marketplace that serves this plugin (the
+# Scribe app's own repo). Instance-global (stored on an admin account) so every
+# user's Settings page shows the real, copyable install command.
+_MARKETPLACE_KEY = "plugin_marketplace_url"
+
 
 @plugin_bp.get("/context")
 @login_required
@@ -30,3 +36,25 @@ async def session_context():
         project_id = 0
     result = await plugin_ctx_svc.build_session_context(g.user.id, project_id)
     return jsonify(result)
+
+
+@plugin_bp.get("/marketplace-url")
+@login_required
+async def get_marketplace_url():
+    """The plugin marketplace git URL, readable by any logged-in user so their
+    Settings page can show a copyable install command."""
+    return jsonify({"marketplace_url": await get_admin_setting(_MARKETPLACE_KEY)})
+
+
+@plugin_bp.put("/marketplace-url")
+@admin_required
+async def set_marketplace_url():
+    """Admin-set the marketplace git URL (e.g. this app's own repo)."""
+    data = await request.get_json() or {}
+    url = (data.get("marketplace_url") or "").strip()
+    if url:
+        scheme = url.split("://")[0].lower() if "://" in url else ""
+        if scheme not in ("http", "https"):
+            return jsonify({"error": "Marketplace URL must use http or https"}), 400
+    await set_setting(get_current_user_id(), _MARKETPLACE_KEY, url)
+    return jsonify({"status": "ok"})

src/scribe/services/settings.py

@@ -4,10 +4,28 @@ from sqlalchemy import delete as sa_delete, select
 
 from scribe.models import async_session
 from scribe.models.setting import Setting
+from scribe.models.user import User
 
 logger = logging.getLogger(__name__)
 
 
+async def get_admin_setting(key: str, default: str = "") -> str:
+    """Read an instance-global setting (one stored on an admin account).
+
+    Used for settings that aren't per-user — e.g. the plugin marketplace URL
+    shown to everyone in Settings. Mirrors the admin-scoped lookup used for
+    the application base URL.
+    """
+    async with async_session() as session:
+        result = await session.execute(
+            select(Setting)
+            .join(User, Setting.user_id == User.id)
+            .where(User.role == "admin", Setting.key == key)
+        )
+        setting = result.scalars().first()
+        return setting.value if setting and setting.value else default
+
+
 async def get_setting(user_id: int, key: str, default: str = "") -> str:
     async with async_session() as session:
         result = await session.execute(