plugins: let owners re-run the security scan from the listing menu

[deanrie]

Summary

Implements the proposal in #447: a self-serve Re-run scan for plugin owners. Over the past weeks most owner issues here (#414, #422, #424, #430, #431, #435, #437, #448, #451, #456) are the same request: "the scan flagged / errored, I fixed the listing, please re-run it", which today only an admin can do.

• actions/rescan-own-plugin.ts: authActionClient action. Checks ownership, refuses permanently_blocked rows, only allows flagged / error / unscanned (so pending/scanning cannot be double-queued and safe has nothing to do), applies the existing per-user pluginScanLimit that already caps create/update scans, then calls the same rescanPlugin() the admin action uses (status reset to pending, queue, drain kick, cache invalidation, moderation event recorded with the owner as actor).
• plugin-owner-menu.tsx: a Re-run scan item, shown only when the same conditions hold client-side; toast on success and router.refresh().

No schema or RLS changes: the owner already has update rights on their own row (toggle-plugin-listing relies on that), and rescanPlugin goes through the server client like the other owner actions.

Open questions for the maintainers

• Whether a flagged plugin should be owner-rescannable at all, or only error/unscanned. I kept flagged in because that is the case every one of the linked issues is about; the flag is a scan result, not a moderation decision, and permanently_blocked (the moderation decision) stays admin-only.
• Rate limit: reusing pluginScanLimit means re-scans share the hourly budget with edits. A separate, tighter id is a one-line change if scans need their own cap (they are billable SDK runs).

Verification

• biome check on both files clean; tsc --noEmit in apps/cursor clean.
• Not exercised against a live queue from this side (no admin or publisher account on the directory); the action path is the admin rescanPlugin() unchanged, with the gates above in front of it.

[vercel]

@deanrie is attempting to deploy a commit to the Anysphere Team on Vercel.

A member of the Team first needs to authorize it.