v0.7.3 — Composable admin dashboard + plugin install fix

Highlights

The admin Dashboard tab is now a composable widget grid: drag-and-drop, three built-in widgets shipped, and plugins can contribute their own via a typed hook point. Plus the plugin install path is fixed for the Docker setups where /tmp and /app live on different filesystems.

Features

• Composable admin dashboard. A drag-and-drop widget grid replaces the static DashboardTab. Three built-ins ship out of the box: stats counters (users / pending requests / services / plugins), service health (reachability + version per configured service), and system (Oscarr version + plugin update count). The layout is persisted globally per Oscarr instance.
• Plugin-extensible. Plugins contribute widgets via the new admin.dashboard.widget hook point. A typed Zod sub-schema validates widget props (id, title, icon, defaultSize, minSize, maxSize) at plugin load — malformed manifests are rejected before the widget can reach the dashboard.
• WYSIWYG edit mode. Editing the dashboard no longer wraps each widget in an extra card with a redundant title. The drag handle and remove button float in the corners with a dashed outline; what you see in edit is what you get in view.

Fixes

• Plugin install across filesystems. Plugin tarballs used to be staged under os.tmpdir() and then renamed into <pluginsDir>/<id>. In Docker setups where /tmp is a tmpfs mount and /app lives on the persistent volume, fs.rename threw EXDEV ("cross-device link not permitted") and installs failed after a successful download. The installer now stages inside the plugins dir itself (under a hidden name the loader ignores) so the final rename is atomic.

Plugin contract

A new section in docs/plugins.md documents the admin.dashboard.widget hook point — manifest example, props schema, frontend contract.

---

Full changelog: v0.7.2...v0.7.3

Upgrading

```
docker pull ghcr.io/arediss/oscarr:0.7.3
```
or
```
docker pull ghcr.io/arediss/oscarr:latest
```