p4(api): Admin marketplace listing endpoint (gated) (#21)

* p4(ui): add PluginMarketplace skeleton component (not wired yet)

* p4(api): add admin marketplace listing endpoint (disabled by default)

---------

Co-authored-by: Faxbot Agent <[email protected]>

Author: DMontgomery40

api/app/main.py

@@ -316,6 +316,14 @@ async def v4_config_flush_cache(scope: Optional[str] = None):
     # Non-fatal if health monitoring deps missing
     pass
 
+# Admin marketplace (Phase 4; disabled by default)
+try:
+    from .routers import admin_marketplace as _marketplace
+    app.include_router(_marketplace.router)
+except Exception:
+    # Non-fatal if marketplace router cannot be imported
+    pass
+
 # Webhook hardening router (DLQ + idempotency)
 try:
     from .routers import webhooks_v2 as _webhooks_v2

api/app/routers/admin_marketplace.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+import os
+from typing import Optional
+from fastapi import APIRouter, Depends, Header, HTTPException
+from api.app.config import settings
+from api.app.auth import verify_db_key
+
+
+def require_admin(x_api_key: Optional[str] = Header(default=None)):
+    """Minimal admin auth dependency for marketplace endpoints.
+    - Accepts env bootstrap API key
+    - Or a DB-backed key with scope keys:manage
+    """
+    if settings.api_key and x_api_key == settings.api_key:
+        return {"admin": True, "key_id": "env"}
+    info = verify_db_key(x_api_key)
+    if not info or ("keys:manage" not in (info.get("scopes") or [])):
+        raise HTTPException(401, detail="Admin authentication failed")
+    return info
+
+
+router = APIRouter(prefix="/admin/marketplace", tags=["AdminMarketplace"], dependencies=[Depends(require_admin)])
+
+
+@router.get("/plugins")
+def list_plugins():
+    """List available plugins in the marketplace (disabled by default).
+
+    Gate with ADMIN_MARKETPLACE_ENABLED=false by default to avoid exposing in prod
+    until features are complete.
+    """
+    enabled = os.getenv("ADMIN_MARKETPLACE_ENABLED", "false").lower() in {"1", "true", "yes"}
+    if not enabled:
+        # Hide endpoint when disabled to avoid confusing operators
+        raise HTTPException(404, detail="Not found")
+    # Placeholder: will be populated via trait‑aware registry in later PRs
+    return {"plugins": []}
+