[manuelmayer-dev]

Summary

Creators on the Macro Deck Platform can now invite up to ten testers to a plugin (TestFlight-style). This PR is the Macro Deck side: a signed-in tester sees the test builds of the plugins they test in a new Tests tab of the Store and installs them.

• Platform client: GET api/v1/store/tests lists the tested plugins with their builds for the signed-in account; POST api/v1/store/tests/{packageId}/builds/{buildId}/download returns a short-lived link and the SHA-256 the bytes must match.
• Host: new api/store/tests (list, install). A test install is a store operation of kind TestInstall, so progress uses the existing operation events. The host checks that the Platform lists the build for this account before starting, and requests the download link itself when the operation runs; nothing about the URL or digest comes from the UI.
• Trust (ADR 0090, amends ADR 0044): test builds are a new source kind TestBuild. They are unsigned, so every install needs explicit consent, but not Developer Mode, and they may replace a plugin admitted as trusted. The persisted tier is not lowered, so a later non-test unsigned update is still refused. Signatures that do not verify are still refused, and the package must carry the listed plugin id. A failed test install is not retryable, so consent is asked again.
• UI: a third Store view, Tests (/store/tests), in the Discover / Installed switcher, offered only when signed in and not behind the StoreTester coming-soon gate; that overlay offers "Open your tests" to a signed-in account. One card per plugin, builds with version, build number, changelog, install / installed / progress, and a confirmation modal before every install.
• Localization for all shipped languages, user guide section, ADR 0090.

The Platform side is already on Macro-Deck-Platform main.

Testing

• dotnet build MacroDeck.slnx -c Release -warnaserror
• Host unit tests: new StoreTestBuildInstallTests against real signed/unsigned/tampered archives and a real trust evaluator (consent required, no Developer Mode needed, replaces a trusted install, newer build of the same version, other plugin id refused, digest mismatch, build not listed for the account starts nothing, broken signature refused), StorePlatformClientTests for the two endpoints, auth matrix for the new routes, trust acceptance test extended to the new source kind. Full host suite after rebasing onto Add an installed extensions page and automatic extension updates #917: 8760 passed.
• Localization tests: 48 passed, no drift.
• ui/angular: npm run build:prod clean, npm test 4188 passed; ui/web-client build and 465 specs passed.
• Not checked in the running app against a live Platform (the mock Platform serves http links, which the host refuses by design).

Known unrelated failures in the full solution run: MacroDeck.Plugin.Protocol.Tests.UnitTests (protocol docs miss host.asset.*) and a signing test that also counts files under local .claude/worktrees.

Plugin SDK / API compatibility

No public, non-obsolete SDK or plugin protocol contract was changed; all changes are in the host and desktop UI.

• No public, non-obsolete SDK or plugin protocol contract was removed or changed

Notes

Limitation: with a test build of 1.2.0 installed, a Store release of the same 1.2.0 is not offered as an update.