Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
46d01be10f