Admin plugin install from the directory (#553) - #570

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…joined Init errors (#553)

Init no longer stops at the first failing OnInit (#569).

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…ectory plugins (#553)

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

… downloads (#553)

Fix round 1 from review: hold a mutex across Install/Update/Uninstall so a
concurrent call on the same name can't delete the winner's file; add a
hookBeforeRegister test seam to actually exercise Update's rename -> write
-> register -> rollback path (the existing test only hit the earlier,
pre-write rejection); validate plugin names against the directory's
ValidName before they reach a filesystem path; refuse HTTP redirects off
https/loopback; force a re-fetch when the configured index URL changes
instead of waiting out Ensure's throttle; add ErrUpToDate/ErrDownload
sentinels; and clean up a leaked temp file on a failed atomic rename.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

)

Status() now drops index entries with an invalid name (same check
lookup() already applies) and strips any source_url/download_url that
isn't an absolute http(s) URL, so a hostile plugin_directory_url can't
smuggle a javascript: link or an unsafe name into the admin page.
The Plugins page stops building onclick/onchange from directory data
(entity-decoding happens before evaluation) in favor of data-action/
data-name attributes read by delegated listeners, and only renders
Source/Directory-page links whose value passes the same scheme/name
checks client-side.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Address the final whole-branch review's two Important findings:

- ensureIndex only forced a refresh when the directory URL changed, so
  Fetcher.Ensure's "fetch once while empty" behaviour meant an already-
  cached index (and thus "update available") never refreshed on its own.
  Add a staleAfter threshold and refresh once the cache is older than that.
- An unwritable or missing plugins/dynamic/ surfaced as a generic 500.
  Add ErrWrite, wrap the installer's write/rename/remove failures in it,
  map it to 507 in the admin API, and have Status() probe writability so
  the admin page can explain the problem and disable Install instead of
  letting every action fail.

Also fixes the minors from the same review: a non-semver installed
version now gets an accurate "not semver" message instead of "already at
the directory's version" on Update; a comment explains why the update
rollback re-runs OnInit; the Uninstall remove failure reuses ErrWrite;
the admin page's plugin-action buttons now always reset even if the
follow-up status reload fails; and the "requires goblog >= X" text is
only shown when the plugin actually declares a minimum version.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

)

Docs follow-ups from the final whole-branch review: hello.go.example and
the README both said dynamic plugins are only interpreted "at startup",
which is no longer true now that Admin -> Plugins can load one at
runtime. Also spell out that plugin_directory_url is a trust decision
(whatever it points at can run code inside goblog) and that an update's
old interpreter instance stays around harmlessly until restart.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>