feat(etsy-manager): add Etsy shop management plugin (MCP, 41 tools)

[hgozutok]

Plugin type (required) / 插件类型（必填）

Select exactly one before requesting review. / 发起评审前必须且只能勾选一项。

• UI Plugin / 是 UI 插件 — provides MCP Apps interactive pages / 提供 MCP Apps 交互页面
• Standard plugin / 普通插件（非 UI） — does not provide MCP Apps interactive pages / 不提供 MCP Apps 交互页面
• Not applicable / 不适用 — repository-only changes; no plugin content changed / 仅仓库级改动，不涉及插件内容

Affected plugin name(s) / 涉及的插件名称：

etsy-manager (new)

What / 改动内容

Adds etsy-manager, a community plugin for managing an Etsy shop from ZCode: search/create/update/delete listings, image/video upload, inventory & variations, shipping profiles, orders/receipts, shipments, reviews, payments and taxonomy lookup — 41 MCP tools on top of the Etsy Open API v3 (vendored from aserper/etsy-mcp, MIT, credited and licensed under vendor/etsy-mcp/LICENSE).

Architecture notes:

• The MCP server ships as a single self-contained esbuild bundle (vendor/etsy-mcp/server-bundle.mjs, ~1.3 MB) — no committed node_modules, no install step, matching the repo convention. The open dependency was replaced with an inline cross-platform browser launcher and dotenv made optional, so the bundle has zero runtime dependencies.
• No secrets are bundled. Etsy API credentials are read at runtime from ETSY_API_KEY/ETSY_SHARED_SECRET env vars or ~/.etsy-mcp/config.json; OAuth tokens live in ~/.etsy-mcp/tokens.json (documented in the READMEs).
• Headless/VPS support (patched on top of upstream): the authenticate tool is non-blocking and returns the OAuth consent URL directly in the tool result (with SSH-tunnel instructions), the callback server binds loopback-only on a fixed port (3737), browser-launch failures never break the flow, and ETSY_NO_BROWSER=1 disables the attempt entirely.
• Documented side effects: HTTPS calls to api.etsy.com/www.etsy.com; a temporary loopback HTTP server (port 3737, ≤2 min) during OAuth; reads/writes only inside ~/.etsy-mcp/. Requires Node.js ≥ 20 on PATH (the only runtime requirement).
• Source & provenance: the patched TypeScript sources live in the publisher's repository (MIT); README (EN) / README_TR / README_CN included and equivalent.

Self-check / 自查清单

• Plugin name is unique kebab-case; new external plugin directory is external_plugins/<name>/; existing fixes retain ownership / 插件名唯一且 kebab-case，外部新增插件位于 external_plugins/<name>/
• Usage category is set independently of publisher ownership / 用途分类 category 已填写，与维护归属分开 — productivity
• Plugin type and affected names are declared above / 已在上方声明插件类型与涉及的插件名称
• version bumped in BOTH plugin.json and marketplace.json (artifacts are immutable) / 两处版本号一致（新插件，0.1.1）
• README.md (EN) and README_CN.md (中文) both updated and equivalent / 中英文 README 均已提供且语义一致
• description_i18n has both en and zh-CN / description_i18n 包含 en 与 zh-CN（plugin.json 与 marketplace 条目一致）
• No secrets, machine-specific paths, or private dependencies / 不含密钥、机器专属路径或私有依赖
• Model/API/network dependencies documented / 模型、API、网络依赖已写明（Etsy Open API v3 + personal API key；README「Side effects」节）
• python3 scripts/validate.py and python3 scripts/build_dist.py pass locally / 本地校验与构建均通过 — see note below

Validation note (honest reporting): python scripts/validate.py passes fully (OK: 42 plugin(s) validated). build_dist.py aborts on my machine at the pre-existing blender UI plugin, which requires pnpm build output (ui-plugins/blender is not built in a fresh clone without pnpm — unrelated to this change). For the new entry itself, build_zip('external_plugins/etsy-manager', …) runs clean (9 files, 249 KB zip, sha256 fc9dc663…), and I verified the extracted zip end-to-end: launching scripts/mcp-server.mjs from it completes the MCP handshake and lists all 41 tools with fake credentials.

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.