Add 9Router control plugin

[weinguyen1224-glitch]

This commit introduces the initial version of the 9Router control plugin. It provides a Noctalia panel to manage 9Router model combos directly from the bar, without requiring the web dashboard.

Key features:

• List, create, rename, and delete model combos.
• Reorder models within a combo via drag-and-drop.
• Change combo routing kind (fallback, round-robin, fusion).
• Search and filter combos.
• Supports 9Router dashboard authentication via CLI token or password.

Includes a bar widget showing connection status, a full UI panel, and a background service to interact with the 9Router REST API. Translations for English and Vietnamese are included.

Plugin

• Id: weinguyen/9router-panel
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

External dependencies

Testing

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against:
• Plugin API level:

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - 9router-control/service.luau:169

The user-configurable data_dir is concatenated directly into a shell command without quoting. Shell metacharacters in this setting can execute arbitrary commands in the user's session when CLI-token computation runs after an authentication challenge. Pass paths through a safe argument API or apply complete shell quoting before invoking the command.

2. blocking - 9router-control/service.luau:466

The user-configurable server_host becomes part of an unquoted curl URL. Shell metacharacters in the host are interpreted when password login runs, allowing arbitrary command execution. Use the native HTTP API for login, a non-shell argument API, or correctly quote the complete URL.

3. blocking - 9router-control/plugin.toml:10

The manifest declares no dependencies, but service.luau:155, service.luau:169, and service.luau:466 spawn external commands including sleep, cat, sha256sum, cut, and curl. Authentication can fail when these commands are unavailable, and the catalog cannot communicate the requirements. Declare the required commands and document each one under README.md's Requirements section.

+  No need for LICENSE file