v0.7.7 — Customisable dashboard, plugin install metrics & live nav refresh

Highlights

The admin dashboard becomes customisable per tab and per widget, the Discover tab surfaces install counts, and the nav refreshes live when you toggle a plugin. Plus the usual sweep of fixes for stale badges, broken caches, and stuck "Copy" buttons.

Features

• Customisable dashboard tabs and widgets. Pick an icon for each tab from a curated 56-icon set. Each widget gets a Pencil edit button in edit mode → custom title, custom icon, or just toggle "show header" to surface the widget's default title. Custom overrides survive drag/resize.
• Live install count on the Discover tab. Each plugin card now shows the total number of GitHub release-asset downloads next to the star count. GitHub increments the counter on every install — no extra infra. Plugins that ship a source tarball (instead of a Release asset) show 0 since GitHub doesn't track those.
• Verbose request log toggle. New opt-in toggle in Admin → Système → Instance → Debug that persists every /api/* response to AppLog with method, path, status, redirect Location, duration, IP and User-Agent. Useful for tracing OAuth round-trips or plugin proxy redirects on a live instance. Off by default; URLs and Referer scrubbed via the existing scrubSecrets pipeline.
• Plugin tab URL sync. Admin → Plugins → Installed / Discover sub-tab now syncs to the URL via ?sub=. Refresh, bookmark or share a link and you land on the right tab.

Fixes

• Live nav refresh on plugin toggle. Toggling a plugin used to leave its nav entries / dashboard widgets stuck until F5. usePluginUI gains a pub/sub: invalidating the cache notifies every mounted hook so contributions refetch in place. The toggle pill itself shows a spinner with "Enabling…" / "Disabling…" copy while the request is in flight.
• Stale "update available" badge. After installing a fresh version (say v0.1.2), the badge would still claim "v0.1.1 available" until the 1h cache TTL passed — it compared with latest !== installed instead of strict semver. The check is now latest > installed (semver-aware) AND the cache invalidates on install/uninstall so the badge clears immediately.
• Update resolver follows /releases when /latest 404s. GitHub returns 404 on /releases/latest when no release is explicitly flagged as latest (some CI workflows skip the flag, plus transient API hiccups). The resolver now falls back to /releases?per_page=30 sorted by semver desc — same logic GitHub uses internally.
• Bust stale browser caches on version flip. Stale HTML cached for /api/* URLs (from a past misconfig) could load the SPA shell on backend routes and produce blank pages. The SPA fallback now sets Cache-Control: no-store on index.html, and /api/app/version sends Clear-Site-Data: "cache" when the client's oscarr_v cookie doesn't match the running version — Chrome/Firefox/Edge purge their HTTP cache for the site on the spot. Sessions, settings and JWT survive.
• Logs "Copy" button works on LAN dev. navigator.clipboard requires a secure context (HTTPS or localhost). Dev over a LAN IP had no clipboard, so the button silently failed. New helper falls back to document.execCommand('copy') via a hidden textarea so the copy works on plain HTTP origins.

Schema migration

New boolean column AppSettings.verboseRequestLog (default false). Idempotent on existing rows.

---

Full changelog: v0.7.6...v0.7.7

Upgrading

```
docker pull ghcr.io/arediss/oscarr:0.7.7
```
or
```
docker pull ghcr.io/arediss/oscarr:latest
```