Add an import plugin system, with the Overpass POI query as its first plugin

A plugin is a directory under plugins/ with a plugin.json manifest
({"label": "...", "command": "./run.sh"}) plus a script that reads
--south/--west/--north/--east and prints a GeoJSON FeatureCollection
to stdout (lib/maptool/plugins.rb) — that's the entire interface a
plugin needs to know about this app. The sidebar's new import icon
(logged in only, GET /api/plugins + POST /api/plugins/:name/run) lists
whatever's found and runs one for the current map viewport, saving its
output as a new .geojson file the same way an upload would be.

The point: a scraper for a site whose ToS forbids that (Park4Night,
iOverlander, Freecampsites) doesn't need to live in this public repo
to work here — its own directory just goes under plugins/ locally and
is never git add'ed, no special-casing needed anywhere.

plugins/overpass-pois wraps the existing rake overpass:pois query as
the first, in-repo, reference example of the contract.

Also fills in four modules (auth.js, locate.js, measure.js, notes.js)
missing from layout.erb's cache-busting importmap alongside adding
plugins.js's own entry — a pre-existing gap that meant they could keep
serving a stale cached copy across a deploy despite the importmap
existing specifically to prevent that.

docs/development.adoc

@@ -65,12 +65,31 @@ https://github.com/protomaps/go-pmtiles[go-pmtiles], same as
 https://overpass-api.de[Overpass] for drinking water, dump stations,
 LPG refill, public toilets, laundromats, supermarkets/convenience
 stores, and springs within a bbox, and writes the result as a
-`.geojson` file (`lib/maptool/overpass_pois.rb`). A dev-time tool, not
-something the running app calls itself — drop the output into
-`data/gpx/` (or upload it through the Tracks panel) like any other
-`.geojson` layer once it's generated. Nodes only (nothing that's
-mapped as a way/relation, e.g. a supermarket traced as a building
-outline rather than a single point).
+`.geojson` file (`lib/maptool/overpass_pois.rb`). Nodes only (nothing
+that's mapped as a way/relation, e.g. a supermarket traced as a
+building outline rather than a single point). Also reachable from
+inside the running app itself, without the command line — see Import
+plugins below, which wraps this exact query as `plugins/overpass-pois`.
+
+== Import plugins
+
+The sidebar's import icon (logged in only) lists whatever's under
+`plugins/` and runs one for the current map viewport with a click — no
+area-picker to fill in, the visible area *is* the area. Each plugin is
+a directory with a `plugin.json` manifest (`{"label": "...", "command":
+"./run.sh"}`) plus whatever script that command names; the entire
+interface a plugin needs to know about maptool is "read
+`--south`/`--west`/`--north`/`--east`, print a GeoJSON
+`FeatureCollection` to stdout" (`lib/maptool/plugins.rb`) — the result
+is saved as a new `.geojson` file the same way an upload would be.
+
+`plugins/overpass-pois` ships as the reference example (a thin wrapper
+around the `rake overpass:pois` logic above). A plugin that scrapes a
+site whose terms of service forbid that — Park4Night, iOverlander,
+Freecampsites — doesn't have to live in this (public) repo to work
+here: drop its directory under `plugins/` locally and just don't
+`git add` it, same as any other local-only file this app already
+treats that way (`data/offline.pmtiles`, the kiwix ZIM, ...).
 
 == Offline Wikipedia (kiwix-serve)