feat(plugins): richer admin panel + registry detail view

Admin list: flush-left header like Addons, type/reviewed badges, runtime
health as a dot on the icon tile (text badge only for problem states),
description + source-repo link on installed cards, manifest icon.

Browse: cards show the plugin screenshot (docs/screenshot.png at the pinned
commit) and open a detail dialog fed by GET /api/admin/plugins/registry/:id —
live-manifest permissions in plain language, egress hosts, setup preview,
repo/homepage links. Manifest fetched server-side through safeDownload at the
reviewed commit, cached per plugin for 30 min and only when a detail opens.

Also fixes the update flow (restart the running child around the install,
keep the admin's enabled intent instead of force-activating disabled
plugins), guards the icon lookup against Object.prototype names, reserves
ids that would shadow static admin routes, stops negative-caching failed
manifest fetches, and makes the version compare prerelease-safe.

shared/src/i18n/de/admin.ts

@@ -200,6 +200,28 @@ const admin: TranslationStrings = {
   'admin.plugins.status.disabled': 'Deaktiviert',
   'admin.plugins.status.error': 'Fehler',
   'admin.plugins.status.incompatible': 'Inkompatibel',
+  'admin.plugins.details': 'Details',
+  'admin.plugins.detailError': 'Plugin-Details konnten nicht geladen werden.',
+  'admin.plugins.permissionsTitle': 'Berechtigungen',
+  'admin.plugins.noPermissions': 'Dieses Plugin benötigt keine besonderen Berechtigungen.',
+  'admin.plugins.egressNote': 'Darf verbinden zu: {hosts}',
+  'admin.plugins.setupTitle': 'Einrichtung',
+  'admin.plugins.noSetup': 'Funktioniert sofort — nichts zu konfigurieren.',
+  'admin.plugins.scope.instance': 'Instanzweit',
+  'admin.plugins.scope.user': 'Pro Nutzer',
+  'admin.plugins.fieldRequired': 'Erforderlich',
+  'admin.plugins.sourceRepo': 'Quell-Repository',
+  'admin.plugins.homepage': 'Homepage',
+  'admin.plugins.requiresTrek': 'Benötigt TREK {version}+',
+  'admin.plugins.reviewedOn': 'Geprüft am {date}',
+  'admin.plugins.perm.db:own': 'Eigene Daten in einer isolierten Datenbank speichern',
+  'admin.plugins.perm.db:read:trips': 'Reisen lesen, auf die der handelnde Nutzer Zugriff hat',
+  'admin.plugins.perm.db:read:users': 'Grundlegende Profilinfos lesen (Name, Avatar — nie Zugangsdaten)',
+  'admin.plugins.perm.ws:broadcast:trip': 'Echtzeit-Updates an Reisemitglieder senden',
+  'admin.plugins.perm.ws:broadcast:user': 'Echtzeit-Updates an einzelne Nutzer senden',
+  'admin.plugins.perm.hook:photo-provider': 'Fotos für Erinnerungen bereitstellen',
+  'admin.plugins.perm.hook:calendar-source': 'Termine für den Kalender bereitstellen',
+  'admin.plugins.perm.http:outbound': 'Ausgehende Anfragen an deklarierte Hosts stellen',
   'admin.addons.title': 'Addons',
   'admin.addons.subtitle': 'Aktiviere oder deaktiviere Funktionen, um TREK nach deinen Wünschen anzupassen.',
   'admin.addons.catalog.packing.name': 'Listen',

shared/src/i18n/en/admin.ts

@@ -252,6 +252,28 @@ const admin: TranslationStrings = {
   'admin.plugins.status.disabled': 'Disabled',
   'admin.plugins.status.error': 'Error',
   'admin.plugins.status.incompatible': 'Incompatible',
+  'admin.plugins.details': 'Details',
+  'admin.plugins.detailError': 'Could not load plugin details.',
+  'admin.plugins.permissionsTitle': 'Permissions',
+  'admin.plugins.noPermissions': 'This plugin requests no special permissions.',
+  'admin.plugins.egressNote': 'May connect to: {hosts}',
+  'admin.plugins.setupTitle': 'Setup',
+  'admin.plugins.noSetup': 'Works out of the box — nothing to configure.',
+  'admin.plugins.scope.instance': 'Instance-wide',
+  'admin.plugins.scope.user': 'Per user',
+  'admin.plugins.fieldRequired': 'Required',
+  'admin.plugins.sourceRepo': 'Source repository',
+  'admin.plugins.homepage': 'Homepage',
+  'admin.plugins.requiresTrek': 'Requires TREK {version}+',
+  'admin.plugins.reviewedOn': 'Reviewed {date}',
+  'admin.plugins.perm.db:own': 'Store its own data in an isolated database',
+  'admin.plugins.perm.db:read:trips': 'Read trips the acting user can access',
+  'admin.plugins.perm.db:read:users': 'Read basic profile info (name, avatar — never credentials)',
+  'admin.plugins.perm.ws:broadcast:trip': 'Send real-time updates to trip members',
+  'admin.plugins.perm.ws:broadcast:user': 'Send real-time updates to individual users',
+  'admin.plugins.perm.hook:photo-provider': 'Provide photos to Memories',
+  'admin.plugins.perm.hook:calendar-source': 'Provide events to the calendar',
+  'admin.plugins.perm.http:outbound': 'Make outbound requests to its declared hosts',
   'admin.addons.title': 'Addons',
   'admin.addons.subtitle': 'Enable or disable features to customize your TREK experience.',
   'admin.addons.catalog.packing.name': 'Lists',