GET /plugins/opencode/forge.ts serves the OpenCode plugin from the forge's own file, landed from the work in pull #9963 #9980

Replaces #9936. Its work is written. #9950 went red because the Docker image lacked plugins/opencode/, and #9963 fixed that. #9963 then went red only on an unrelated sign-in test. This issue lands that work once the flaky tests are fixed.

Done when:

• [ ] GET /plugins/opencode/forge.ts answers the bytes of plugins/opencode/forge.ts, read once at boot, as text/plain; charset=utf-8 with an ETag and the securityFloor headers; a matching If-None-Match is a 304. The route lives in its own module (src/http/plugin_routes.ts), and plugins is a reserved name.
• [ ] The Dockerfile copies plugins/opencode/ into the image, and a test proves the release image's file list includes it (the cause of #9950's red).
• [ ] /settings/tokens' OpenCode line and plugins/opencode/README.md show mkdir -p .opencode/plugin && curl -fsSo .opencode/plugin/forge.ts <forge>/plugins/opencode/forge.ts with the forge's address filled in; the clone route stays as the second way.
• [ ] The route test fails on main and passes with the change; bun test is green.

Files: src/http/plugin_routes.ts (new), src/http/server.ts, the reserved-names list, Dockerfile, the tokens page, plugins/opencode/README.md, a test.

Start from: pull #9963's diff; rebase it on main, and don't rewrite it.

Replaced by #10198: not on main; re-planned as ready work under P5 now that its parents were dropped.