feat: add plugin system (#1034)

* feat: add plugin system

* fix db docker build

* fix hammerhead readme, add strava subscription news to docs

* fixes and sdk improvements

* fix: reduce Meilisearch load, debounce federation sync (#1012)

* optimize meili trail index

* several fixes

---------

Co-authored-by: Flomp <Flomp@users.noreply.github.com>

* Bump svelte from 5.55.5 to 5.56.0 in /docs (#1032)

Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.56.0.
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.0/packages/svelte)

---
updated-dependencies:
- dependency-name: svelte
  dependency-version: 5.56.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Flomp <Flomp@users.noreply.github.com>

* Release v0.19.2 (#1035)

* chore: release v0.19.2

* add changelog

---------

Co-authored-by: Flomp <26000991+Flomp@users.noreply.github.com>
Co-authored-by: Christian Beutel <>

* speed up plugin sync and several small fixes

* concepts for security improvements and process stability

* improve concept

* security concept implemented

* remove insecure TLS

* worker concept implemented

* fixes and cleanup

* fixes

* docu

* mermaid, namings

* WASM plugin host improvements, plugin logging

* fix db migration

* Improve plugin config and category mapping UI

* fixes

* further fixes

* remove manual test sync

* fix db migration and strava mapping

* type added, UI improvements

* fix plugin card toggle clickable area

* optimize synch status card layout

* plugin type 'trails' instead of 'integration'

* session auth validation in UI

* fix komoot date and waypoints

* improve category mapping

* fix send to hammerhead: trail name

* plugin setup error handling improved

* fix review findings

* re-mapping added

* rename remote_category

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Flomp <Flomp@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Flomp <26000991+Flomp@users.noreply.github.com>

plugins/sdk/gpx/gpx.go

@@ -0,0 +1,58 @@
+package gpx
+
+import (
+	"bytes"
+	"encoding/xml"
+	"fmt"
+	"strconv"
+	"time"
+)
+
+type Point struct {
+	Lat       float64
+	Lon       float64
+	Elevation *float64
+	Time      *time.Time
+}
+
+func Track(creator string, name string, points []Point) ([]byte, error) {
+	if len(points) == 0 {
+		return nil, fmt.Errorf("track has no points")
+	}
+	if creator == "" {
+		creator = "wanderer plugin"
+	}
+
+	var buf bytes.Buffer
+	buf.WriteString(xml.Header)
+	buf.WriteString(`<gpx version="1.1" creator="`)
+	_ = xml.EscapeText(&buf, []byte(creator))
+	buf.WriteString(`" xmlns="http://www.topografix.com/GPX/1/1">`)
+	buf.WriteString("<trk>")
+	buf.WriteString("<name>")
+	_ = xml.EscapeText(&buf, []byte(name))
+	buf.WriteString("</name>")
+	buf.WriteString("<trkseg>")
+	for _, point := range points {
+		buf.WriteString(`<trkpt lat="`)
+		buf.WriteString(strconv.FormatFloat(point.Lat, 'f', 8, 64))
+		buf.WriteString(`" lon="`)
+		buf.WriteString(strconv.FormatFloat(point.Lon, 'f', 8, 64))
+		buf.WriteString(`">`)
+		if point.Elevation != nil {
+			buf.WriteString("<ele>")
+			buf.WriteString(strconv.FormatFloat(*point.Elevation, 'f', 2, 64))
+			buf.WriteString("</ele>")
+		}
+		if point.Time != nil {
+			buf.WriteString("<time>")
+			buf.WriteString(point.Time.UTC().Format(time.RFC3339))
+			buf.WriteString("</time>")
+		}
+		buf.WriteString("</trkpt>")
+	}
+	buf.WriteString("</trkseg>")
+	buf.WriteString("</trk>")
+	buf.WriteString("</gpx>")
+	return buf.Bytes(), nil
+}

plugins/sdk/gpx/gpx_test.go

@@ -0,0 +1,39 @@
+package gpx
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestTrackEscapesFields(t *testing.T) {
+	elevation := 123.456
+	timestamp := time.Date(2026, 6, 1, 10, 30, 0, 0, time.UTC)
+	data, err := Track("creator & test", "A & B", []Point{{
+		Lat:       46.1,
+		Lon:       8.2,
+		Elevation: &elevation,
+		Time:      &timestamp,
+	}})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	gpx := string(data)
+	for _, want := range []string{
+		`creator="creator & test"`,
+		"<name>A &amp; B</name>",
+		`lat="46.10000000" lon="8.20000000"`,
+		"<ele>123.46</ele>",
+		"<time>2026-06-01T10:30:00Z</time>",
+	} {
+		if !strings.Contains(gpx, want) {
+			t.Fatalf("expected %q in %s", want, gpx)
+		}
+	}
+}
+
+func TestTrackRejectsEmptyPoints(t *testing.T) {
+	if _, err := Track("", "empty", nil); err == nil {
+		t.Fatal("expected error")
+	}
+}