feat(FN-3077): enforce plugin AI security scan gate across install flows

- Add core plugin AI security scan module and schema support for scan toggle/state metadata
- Enforce scan checks during CLI and dashboard plugin install flows, with preserved API error status on scan failures
- Expose plugin scan toggle and rescan actions in dashboard/plugin manager with route and UI coverage
- Update plugin authoring and CLI/dashboard docs, plus add changeset for published CLI package

Fusion-Task-Id: FN-3077

packages/dashboard/app/api/legacy.ts

@@ -7736,7 +7736,7 @@ export async function fetchPluginDetail(id: string, projectId?: string): Promise
 
 /** Install a plugin from local path or npm package */
 export async function installPlugin(
-  source: { path: string } | { package: string },
+  source: { path: string; aiScanOnLoad?: boolean } | { package: string; aiScanOnLoad?: boolean },
   projectId?: string,
 ): Promise<PluginInstallation> {
   return api<PluginInstallation>(withProjectId("/plugins", projectId), {
@@ -7807,6 +7807,21 @@ export async function reloadPlugin(id: string, projectId?: string): Promise<Plug
   });
 }
 
+/** Update plugin security-scan configuration */
+export async function updatePlugin(id: string, updates: { aiScanOnLoad: boolean }, projectId?: string): Promise<PluginInstallation> {
+  return api<PluginInstallation>(withProjectId(`/plugins/${encodeURIComponent(id)}`, projectId), {
+    method: "PATCH",
+    body: JSON.stringify(updates),
+  });
+}
+
+/** Trigger plugin rescan + reload flow */
+export async function rescanPlugin(id: string, projectId?: string): Promise<PluginInstallation> {
+  return api<PluginInstallation>(withProjectId(`/plugins/${encodeURIComponent(id)}/rescan`, projectId), {
+    method: "POST",
+  });
+}
+
 /** A UI slot entry returned by GET /api/plugins/ui-slots */
 export interface PluginUiSlotEntry {
   pluginId: string;