feat: add dragged/cider now-playing and lyrics HUD

[dragged9698]

Plugin

• Id: dragged/cider
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Cider-only now-playing for Noctalia: track-change notifications or a rich artwork OSD card, a bar chip, and a sticky karaoke lyrics HUD (GTK3 + gtk-layer-shell). Other MPRIS players keep the stock media OSD.

A Python bridge talks to Cider’s local Connectivity API, caches artwork, and pulls Apple Music TTML (LRCLIB fallback) for the overlay. The overlay is click-through text, not a Noctalia panel.

External dependencies

Declared in plugin.toml:

• python3 — runs scripts/cider_bridge.py and scripts/lyrics_overlay.py
• gtk3 / gtk-layer-shell / python-gobject — lyrics overlay (PyGObject + cairo)

Pip packages (see cider/requirements.txt): python-socketio, requests, websocket-client.

Also spawned (not extra manifest names): bash (scripts/start-bridge.sh), pkill (bridge replace / disable), python3.

Testing

Local path-source install plus noctalia plugins lint cider (0 errors, 0 warnings) and python3 -m unittest in cider/scripts (41 tests).

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: v5.0.0-beta.8+
• Plugin API level: 23

Screenshots / Videos

Checklist

Ready-for-review requirement: Every box in this section must be checked. If any statement is not true, keep the
pull request as Draft. An explanation does not replace a required check.

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:
Ready-for-review requirement: Every attestation below must be checked.

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

Network, filesystem, processes

• Network: Cider Connectivity HTTP/Socket.IO on base_url (default http://127.0.0.1:10767). Lyrics via Cider amapi/run-v3; LRCLIB fallback.
• Filesystem writes: ~/.cache/noctalia-cider/ (state, lyrics, artwork, HUD, apptoken file), noctalia.pluginDataDir() durable settings, /tmp/noctalia-cider-bridge.log, /tmp/noctalia-cider-lyrics-overlay.log. No writes into pluginDir().
• Processes: bash scripts/start-bridge.sh → python3 scripts/cider_bridge.py; python3 scripts/lyrics_overlay.py; pkill of the bridge on replace/disable; overlay stop via pidfile.

[ItsLemmy]

1. non-blocking - cider/scripts/cider_bridge.py:998
   The requests.Session at line 715 is configured with the Cider "apptoken"
   and "apitoken" credential headers (lines 719-720) and then reused for the
   remote artwork fetch in _cache_artwork (self._session.get(url), line 998).
   That url is the Apple Music CDN artwork URL from Cider's now-playing payload
   (normalized at cider/scripts/cider_bridge.py:983), so the local Cider API
   token is transmitted as request headers to a third-party host
   (*.mzstatic.com) that has no need for it. The token is a local media-player
   control token rather than a user account credential, and this is header
   reuse rather than deliberate exfiltration, so it is not unsafe or breaking.
   It is a concrete, easily fixed data-handling concern: use a tokenless
   request (a bare requests.get, as already done for the LRCLIB fallback at
   cider/scripts/cider_bridge.py:1154) for the remote CDN download.