P4 — API & routes: contributes.routes (D25–D28)

[aqib-rx]

Summary

• contributes.routes — plugin HTTP endpoints namespaced under /api/plugins/<name> (D25), handlers receive (req, ctx) (D26).
• Secure-by-default: auth + RBAC via requiredPermission, public: true opt-out; inherits CORS/rate-limit/headers (D28).
• Typed, ordered route-level middleware chain (D27).
• @experimental SDK exports; form-builder dogfoods an export route (R4).

Notes

• T11 (wire the dead collection endpoints field) trimmed + documented as a follow-up.

Test plan

• Unit: 405 failed / 32 files = exact documented baseline (zero new) + 24 new route tests passing.
• Integration: same 3 pre-existing/environmental failures; new route auth-matrix + boot tests pass.
• check-types + build green across nextly, @nextlyhq/plugin-sdk, @nextlyhq/plugin-form-builder; form-builder 18/18.

[github-actions]

PR title fails Conventional Commits check

No release type found in pull request title "P4 — API & routes: contributes.routes (D25–D28)". Add a prefix to indicate what kind of release this pull request corresponds to. For reference, see https://www.conventionalcommits.org/

Available types:
 - feat
 - fix
 - docs
 - style
 - refactor
 - perf
 - test
 - build
 - ci
 - chore
 - revert

Examples of valid titles:

• feat(admin): add role manager dialog
• fix(adapter-postgres): handle connection pool exhaustion
• chore(deps): bump zod to 4.2.0