Fix three bugs found reviewing this session's changes

- notes.js's ICON_LABELS wasn't extended for the shop_supermarket/
  shop_convenience keys icons.js added — the note icon picker showed
  the raw internal key as the title instead of a real label.
- Plugins.run mislabeled a malformed plugin.json as "plugin did not
  print valid JSON" — a message written for bad script stdout, not a
  bad manifest, since both paths shared one rescue.
- overpass_pois.rb's description_for joined raw OSM tag values with
  "\n" — an operator/opening_hours tag with an embedded newline could
  inject an extra line into the popup that gpx.js's formatDescription
  (built for p4n2gpx's own well-formed lines) would render as its own
  independent, legitimate-looking link. Tag values are stripped of
  embedded newlines before joining.

test/test_overpass_pois.rb

@@ -56,6 +56,23 @@ class OverpassPoisTest < Minitest::Test
     assert_equal "Opening hours: 24/7\nOperator: Town Council\nhttps://example.com", description
   end
 
+  def test_to_geojson_strips_embedded_newlines_from_tag_values
+    response = {
+      "elements" => [
+        {
+          "type" => "node",
+          "lat" => 48.1,
+          "lon" => 17.2,
+          "tags" => { "amenity" => "toilets", "operator" => "Acme Co\nhttps://evil.example" },
+        },
+      ],
+    }
+
+    description = Maptool::OverpassPois.to_geojson(response)["features"].first["properties"]["description"]
+
+    assert_equal "Operator: Acme Co https://evil.example", description, "an embedded newline must not inject a second, independently-rendered line"
+  end
+
   def test_to_geojson_omits_description_when_no_recognized_tags_are_present
     response = { "elements" => [{ "type" => "node", "lat" => 48.1, "lon" => 17.2, "tags" => { "amenity" => "toilets" } }] }
 

test/test_plugins.rb

@@ -53,6 +53,17 @@ class PluginsTest < Minitest::Test
     assert_raises(Maptool::Plugins::RunError) { Maptool::Plugins.run(@dir, "hello", [1, 2, 3, 4]) }
   end
 
+  # Distinct from the "did not print valid JSON" message above — that one's
+  # about the script's stdout, this is about plugin.json itself, before the
+  # script is ever run. Same exception class either way, but a clear
+  # message matters since this is what a "Failed" plugin run shows the user
+  # (see public/js/plugins.js).
+  def test_run_raises_a_distinct_message_for_an_invalid_manifest
+    File.write(File.join(@plugin_dir, "plugin.json"), "{not valid json")
+    error = assert_raises(Maptool::Plugins::RunError) { Maptool::Plugins.run(@dir, "hello", [1, 2, 3, 4]) }
+    assert_match(/invalid plugin\.json/, error.message)
+  end
+
   # Multiple dirs (app.rb's PLUGINS_DIRS: the built-in plugins/ plus an
   # optional private one under data/plugins/) — list/run both accept an
   # array, not just the single-dir form the tests above exercise.