Wire up p4n2gpx as a private plugin

data/plugins/p4n2gpx/ (outside git, see .gitignore) now holds a
plugin.json + run.rb wrapper around ../p4n2gpx/ruby/p4n2gpx.rb, so it
runs through the same --south/--west/--north/--east-in,
GeoJSON-on-stdout-out contract as the built-in overpass-pois plugin.
run.rb converts the requested bbox to the center+radius p4n2gpx.rb
itself expects, then reuses lib/maptool/gpx.rb to turn its .gpx output
into GeoJSON.

p4n2gpx.rb needs faraday-cookie_jar, which wasn't in the Gemfile yet
(faraday itself already was, transitively via oauth2) — added and
locked. Also wires P4N_USER/P4N_PASSWORD through docker-compose.yaml
and the deploy workflow's "Write .env" step, the same optional-secret
pattern as LIVETRACK_WEBHOOK_SECRET, since the container has no
browser for p4n2gpx.rb's Chrome-cookie auth fallback.

.gitignore

@@ -24,6 +24,12 @@
 # Garmin LiveTrack session IDs received via webhook
 /data/livetrack.json
 
+# Private import plugins (see lib/maptool/plugins.rb's PLUGINS_DIRS,
+# docs/deployment.adoc) — a plugin whose ToS forbids living in this public
+# repo belongs here instead, outside git entirely.
+/data/plugins/*
+!/data/plugins/.gitkeep
+
 # Editor / OS
 .DS_Store
 *.swp