review(#2622): lint cleanup + harden two no-op tests

- Remove unused imports (importlib, sys in api/plugins.py; pytest in test).
- Two tests asserted 'X or True' (always pass — meaningless). Rewrote them to
  actually verify the /plugins/ route allowlists plugin.css + uses relative_to
  traversal guard, and that manifest fields are html.escape()'d before IIFE-shell
  interpolation. Dropped a dead 'original_plugins' local for a real dict assertion.

api/plugins.py

@@ -12,11 +12,9 @@ Each plugin may have:
       style.css     -- optional plugin stylesheet
     plugin_api.py   -- optional backend API (not used in WebUI MVP)
 """
-import importlib
 import json
 import logging
 import os
-import sys
 from pathlib import Path
 
 logger = logging.getLogger(__name__)