feat: add plugin system (#1034)

* feat: add plugin system

* fix db docker build

* fix hammerhead readme, add strava subscription news to docs

* fixes and sdk improvements

* fix: reduce Meilisearch load, debounce federation sync (#1012)

* optimize meili trail index

* several fixes

---------

Co-authored-by: Flomp <Flomp@users.noreply.github.com>

* Bump svelte from 5.55.5 to 5.56.0 in /docs (#1032)

Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.56.0.
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.0/packages/svelte)

---
updated-dependencies:
- dependency-name: svelte
  dependency-version: 5.56.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Flomp <Flomp@users.noreply.github.com>

* Release v0.19.2 (#1035)

* chore: release v0.19.2

* add changelog

---------

Co-authored-by: Flomp <26000991+Flomp@users.noreply.github.com>
Co-authored-by: Christian Beutel <>

* speed up plugin sync and several small fixes

* concepts for security improvements and process stability

* improve concept

* security concept implemented

* remove insecure TLS

* worker concept implemented

* fixes and cleanup

* fixes

* docu

* mermaid, namings

* WASM plugin host improvements, plugin logging

* fix db migration

* Improve plugin config and category mapping UI

* fixes

* further fixes

* remove manual test sync

* fix db migration and strava mapping

* type added, UI improvements

* fix plugin card toggle clickable area

* optimize synch status card layout

* plugin type 'trails' instead of 'integration'

* session auth validation in UI

* fix komoot date and waypoints

* improve category mapping

* fix send to hammerhead: trail name

* plugin setup error handling improved

* fix review findings

* re-mapping added

* rename remote_category

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Flomp <Flomp@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Flomp <26000991+Flomp@users.noreply.github.com>

plugins/sdk/README.md

@@ -0,0 +1,63 @@
+# Wanderer Plugin SDK for Go
+
+TinyGo-compatible helpers for Wanderer WASM plugins.
+
+```go
+import "github.com/open-wanderer/wanderer/plugins/sdk"
+```
+
+The SDK contains only plugin-side protocol types and host-function helpers. It
+does not depend on Wanderer core or PocketBase.
+
+Common protocol types:
+
+- `ListInput`, `ListOutput`, `TrailImport`, `Track`, `Waypoint`, `Photo`
+- `RefreshSessionInput`, `RefreshSessionOutput`
+- `TrailSendInput`, `TrailSendPlan`
+- `HostRequestSpec`, `HostResponse`, `PluginError`
+
+Provider HTTP requests use connector targets. Plugins provide a connector name,
+a relative path, and ordered query parameters; the host owns the final base URL,
+path scope, redirects, TLS, and private-network policy. Public external media
+URLs remain available only through `MediaSource{Type: "url"}`.
+
+Host HTTP request bodies support JSON, `application/x-www-form-urlencoded`, and
+multipart. Use `PostJSON` for JSON and `PostForm` for ordered form fields. Any
+request body, including a login form POST, is governed by manifest
+`permissions.uploads.maxBytes` and `permissions.uploads.contentTypes`; in this
+contract "uploads" means plugin-to-provider request bodies, not only media/file
+uploads.
+
+Set `HostRequestSpec.FollowRedirects` to `sdk.Bool(false)` when a plugin needs
+to inspect a redirect response itself, for example to collect `Location` and
+`Set-Cookie` during a provider login flow. `HostResponse.HeaderValues` is the
+only response-header representation and preserves all values. Prefer
+`FirstHeader` for scalar headers and `HeaderValuesFor` for headers that can
+appear more than once.
+
+Plugins can emit host-visible logs with `LogDebug`, `LogInfo`, `LogWarn`, and
+`LogError`. Log levels are strict (`debug`, `info`, `warn`, `error`) and
+messages must be non-empty. Use logs for short diagnostics and timing markers;
+they are best-effort and should not be part of plugin control flow.
+
+Small sync helpers are included for the repeated mechanics that every provider
+needs:
+
+- `StringField` / `StringOption`
+- `IntState`
+- `IntOption`
+- `KnownIDs`
+- `SyncLimit`
+- `NextPageState`
+
+Additional TinyGo-compatible helper packages:
+
+```go
+import sdkgpx "github.com/open-wanderer/wanderer/plugins/sdk/gpx"
+import "github.com/open-wanderer/wanderer/plugins/sdk/polyline"
+```
+
+- `gpx` writes simple GPX 1.1 track documents from provider track points.
+- `polyline` decodes Google-style encoded polylines and provides small helpers
+  for coordinate scale normalization, coordinate swap detection, and mapping
+  shorter elevation arrays onto track points.