fix(cider): do not send apptoken to Apple artwork CDN

[dragged9698]

Plugin

• Id: dragged/cider
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Bump dragged/cider from 1.8.3 → 1.8.4.

Artwork downloads from Apple Music CDN (*.mzstatic.com) no longer reuse the Cider-authenticated requests.Session. That session carries local apptoken / apitoken headers meant only for Cider’s Connectivity API; sending them to a third-party CDN was unintentional header reuse. Remote artwork now uses a bare requests.get, matching the existing LRCLIB fallback path. Local Cider API calls still use the tokened session.

Also hardens a theme-color unit test so active vs sung assertions stay deterministic when Noctalia theme tokens land on similar greens.

External dependencies

Unchanged from the published plugin. Declared in plugin.toml:

• python3 — runs scripts/cider_bridge.py and scripts/lyrics_overlay.py
• gtk3 / gtk-layer-shell / python-gobject — lyrics overlay (PyGObject + cairo)

Pip packages (see cider/requirements.txt): python-socketio, requests, websocket-client.

Also spawned (not extra manifest names): bash (scripts/start-bridge.sh), pkill (bridge replace / disable), python3.

Testing

• Local python3 -m unittest in cider/scripts (43 tests)

• python3 .github/workflows/scripts/validate-plugins.py (109 manifests OK)

• Review fix for ItsLemmy’s non-blocking note on #406 (cider_bridge.py artwork fetch)

• Tested on Niri

• Tested on Hyprland

• Tested on Sway

• Tested on another compositor:

• Noctalia version tested against: v5.0.0-beta.8+

• Plugin API level: 23

Screenshots / Videos

No UI change in this update. Existing store card for context:

Checklist

Ready-for-review requirement: Every box in this section must be checked. If any statement is not true, keep the
pull request as Draft. An explanation does not replace a required check.

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:
Ready-for-review requirement: Every attestation below must be checked.

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

Network, filesystem, processes

• Network: Cider Connectivity HTTP/Socket.IO on base_url (default http://127.0.0.1:10767) via the tokened Session. Lyrics via Cider amapi/run-v3; LRCLIB fallback and Apple Music CDN artwork via bare requests.get (no Cider token headers).
• Filesystem writes: ~/.cache/noctalia-cider/ (state, lyrics, artwork, HUD, apptoken file), noctalia.pluginDataDir() durable settings, /tmp/noctalia-cider-bridge.log, /tmp/noctalia-cider-lyrics-overlay.log. No writes into pluginDir().
• Processes: bash scripts/start-bridge.sh → python3 scripts/cider_bridge.py; python3 scripts/lyrics_overlay.py; pkill of the bridge on replace/disable; overlay stop via pidfile.