fix: harden plugin feature gating (#15020)

1. Use requirement-resolved config.features as the plugin gate.
2. Guard plugin/list, plugin/read, and related flows behind that gate.
3. Skip bad marketplace.json files instead of failing the whole list.
4. Simplify plugin state and caching.

codex-rs/app-server/src/in_process.rs

@@ -808,6 +808,10 @@ mod tests {
         for (requested_source, expected_source) in [
             (SessionSource::Cli, ApiSessionSource::Cli),
             (SessionSource::Exec, ApiSessionSource::Exec),
+            (
+                SessionSource::Custom("atlas".to_string()),
+                ApiSessionSource::Custom("atlas".to_string()),
+            ),
         ] {
             let client = start_test_client(requested_source).await;
             let response = client