feat: implement plugin management UI

[krbrs]

Summary

Implements the initial Plugin Management feature for the Shoko WebUI based on the new plugin repository and package APIs exposed by Shoko Server.

This PR adds repository management, plugin catalog browsing, installation flows, installed plugin management, and update handling. The implementation was built from the server-side plugin package contract and Spec Kit planning artifacts generated during feature design.

Features

Repository Management

• Add/remove plugin repositories
• Manual repository synchronization
• Repository listing with stale/error handling
• Duplicate repository prevention
• Collapsible repository form UX

Plugin Catalog

• Browse available plugin packages from configured repositories
• Group releases and archive variants by package
• Search/filter support
• Installed-state awareness
• Compatibility handling for runtime/ABI mismatches
• Thumbnail support via server thumbnail endpoint
• Expandable older release history

Plugin Installation & Updates

• Install compatible plugin releases
• Update installed plugins
• Release/archive selection support
• Installation progress and failure handling
• Restart-required state indication

Installed Plugin Management

• List installed plugins and versions
• Enable/disable plugin versions
• Uninstall installed versions
• Distinguish built-in vs installed plugins
• Local plugin state handling

[harshithmohan]

Review Summary

This PR introduces two major features: a Plugin Management UI in settings, and an AniDB rules confirmation modal for the unrecognized files utility. The code is generally well-structured and follows existing patterns, but there are a few issues that should be addressed.

---

🔴 Critical

1. pnpm-workspace.yaml contains unresolved placeholder values

File: pnpm-workspace.yaml

allowBuilds expects boolean values (true/false). The literal strings "set this to true or false" are placeholder text that will cause pnpm to reject or ignore these entries, breaking builds for anyone using pnpm v10.26+. These must be replaced with actual booleans based on whether those packages should be allowed to run postinstall scripts.

---

🟡 Medium

2. Custom version comparison is naive and duplicates existing library

File: src/core/react-query/plugin-package/helpers.ts

The compareVersionStrings helper splits on . and parses segments with Number.parseInt, which silently ignores pre-release suffixes and non-numeric characters. Two versions like 1.0.0-alpha and 1.0.0-beta would both parse as [1, 0, 0] and compare as equal, potentially causing IsUpdateAvailable to be missed.

The project already depends on and uses semver in src/pages/SentryErrorBoundaryWrapper.tsx, src/hooks/useIsFeatureSupported.ts, and src/components/Layout/TopNav.tsx. You should use semver.compare or semver.gt instead of a hand-rolled parser.

3. Broken plugin thumbnails show browser fallback instead of placeholder

File: src/components/Settings/PluginManagement/InstalledPluginsPanel.tsx

Unlike CatalogItem.tsx, which gracefully handles thumbnail load failures via onError + imageFailed state, this image has no error handler. If the thumbnail URL 404s, the user sees a broken image icon. Add onError handling to match the catalog behavior.

4. groupInstalledPlugins uses quadratic-time object spreading

File: src/core/react-query/plugin-package/helpers.ts

Each iteration copies all existing keys into a new object and copies the existing array into a new array. This is O(n²). While plugin counts are likely small enough that it won't matter in practice, this pattern is unnecessarily inefficient and should be replaced with direct mutation of the accumulator (the reducer is local and safe to mutate).

---

🟢 Low / Style

5. Inconsistent hook import style

Files: src/components/Settings/PluginManagement/RepositoryPanel.tsx, src/components/Settings/PluginManagement/PluginUpdatesPanel.tsx

RepositoryPanel.tsx imports useState destructured but then uses React.useState for one call and useState for another. PluginUpdatesPanel.tsx uses React.useState without a destructured import. The codebase overwhelmingly uses destructured imports (import { useState } from 'react'). Pick one style and use it consistently.

[harshithmohan]

Not sure if the comments are valid, I just wanted to use my opencode go quota 😂

[krbrs]

everything except the logo size is currently working well from the tests and reviews; i would re-model the interface eventually in another PR to fit the 16:9 logo if a smaller version is not feasible. Also settings for auto updates are currently not wired in because of testing