[andypalmi]

Description

automation/install-module now installs packages from the instance's own team library (subflows exported as modules, scope @flowfuse-<teamId>/) without a confirmation, as it already does for FlowFuse and certified nodes. Packages from other teams and third-party packages are still refused.

1. Team id from runtime settings. The plugin reads RED.settings.flowforge.teamID on the server and sends it to the editor on nr-assistant/initialise as teamLibrary: { teamId }. It is only sent when it is a plain hashid. The caller never supplies the team.
2. Own scope only. A module in @flowfuse-<teamId>/ is accepted only when <teamId> is the instance's own team. Any other @flowfuse-* scope gets MODULE_NOT_ALLOWED.
3. Must be listed in the team catalogue. The package has to appear in the catalogue at /api/v1/teams/<teamId>/npm/catalogue in palette.catalogues. The platform only adds that catalogue together with the npmrc entry that routes the team scope to the FlowFuse registry. So a listing guarantees npm does not look the scope up on the public registry, where anyone could register a flowfuse-<id> org. The catalogue version is pinned, as for certified nodes.
4. Catalogue matched by path, not origin. The runtime's forgeURL can be an internal address (for example http://forge.<namespace> on Kubernetes), while the catalogue uses the platform's public URL. So the URL is matched on its path for the instance's own team.
5. Mixed-case scopes. Team hashids are mixed case, so the scope part of the package-name check now accepts upper case. The name after the slash stays lower case.

Screenshot

This shows that it got installed

Closes https://github.com/FlowFuse/engineering/issues/448

Testing

Unit tests cover the server-side team id and every install path. Tested end to end on a local platform with a team npm registry, using a subflow published to the team library:

Case	Module	Result
Own team package, listed in catalogue	@flowfuse-aBcD3fGh1J/test-subflow	INSTALL_STARTED, installed from the team registry with the catalogue version (0.1.0), subflow type in the palette
Another team's scope	@flowfuse-otherTeam1/test-subflow	MODULE_NOT_ALLOWED; the error lists the instance's own team scope as the only team scope allowed
Own scope, not published	@flowfuse-aBcD3fGh1J/not-published	MODULE_NOT_ENTITLED, no install request
Third-party package	node-red-contrib-influxdb	Refused, unchanged behaviour (MODULE_NOT_ALLOWED)

The registry log confirmed the package was fetched with the instance's own npm token.

Checklist

• Unit tests added
• Lint and tests pass