Plugins in data/plugins are loaded at startup and can add a tab with a read-only node board, and the demo plugin shows every asset as a node (#113)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/index.php

@@ -25,6 +25,9 @@ declare(strict_types=1);
  *   POST   ?r=sounds&name=x.wav   raw sound bytes    → {file,name,bytes}
  *   DELETE ?r=sounds/{file}       → 204
  *
+ *   GET    ?r=plugins             → [{file,bytes,updatedAt}], sorted by file name
+ *   GET    ?r=plugins/{file}      → the module source as text/javascript
+ *
  * `name` is the file's original name, kept beside it as `{file}.json` (see OriginalName) and
  * empty when none is known. It is a caption, never a path: the stored file is always `{hash}.{ext}`.
  *
@@ -34,6 +37,7 @@ declare(strict_types=1);
 
 require __DIR__ . '/lib/FontStore.php';
 require __DIR__ . '/lib/OriginalName.php';
+require __DIR__ . '/lib/PluginStore.php';
 require __DIR__ . '/lib/Response.php';
 require __DIR__ . '/lib/SoundStore.php';
 require __DIR__ . '/lib/Store.php';
@@ -213,6 +217,30 @@ function routeSounds(array $parts, string $method): never
     Response::error('Method not allowed', 405);
 }
 
+/** @param list<string> $parts */
+function routePlugins(array $parts, string $method): never
+{
+    if ($method !== 'GET') {
+        Response::error('Method not allowed', 405);
+    }
+    $store = new PluginStore(dirname(__DIR__) . '/data/plugins');
+
+    if (count($parts) === 1) {
+        Response::json($store->list());
+    }
+
+    $source = $store->read($parts[1]);
+    if ($source === null) {
+        Response::error('Plugin not found', 404);
+    }
+    header('Content-Type: text/javascript; charset=utf-8');
+    header('X-Content-Type-Options: nosniff');
+    // A replaced file has to be the one the next editor start runs.
+    header('Cache-Control: no-cache');
+    echo $source;
+    exit;
+}
+
 try {
     if ((int) ($_SERVER['CONTENT_LENGTH'] ?? 0) > MAX_BODY_BYTES) {
         Response::error('Request body too large', 413);
@@ -231,6 +259,7 @@ try {
         'textures' => routeTextures($parts, $method),
         'fonts' => routeFonts($parts, $method),
         'sounds' => routeSounds($parts, $method),
+        'plugins' => routePlugins($parts, $method),
         default => Response::error('Not found', 404),
     };
 } catch (Throwable $e) {