feat: add Sticky Notes plugin

[Ahmedhossamdev]

Plugin

• Id: ahmedhossamdev/sticky-notes
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Sticky Notes adds colourful persistent notes and interactive Markdown checklists
to the Noctalia bar. Notes can be pinned, reordered, blurred for privacy, and
stored as Markdown, plain text, or JSON in a user-selected folder.

External dependencies

• mkdir — creates the selected storage folder when needed.
• sh — expands ~ in the configured storage path.
• xdg-open — opens user-provided, validated http://, https://, or www.
  links from notes.

The plugin makes no network calls.

Testing

Tested the bar widget and panel: created, edited, deleted, pinned, reordered,
blurred, and persisted notes. Also tested Markdown checklists using - [ ] and
- [x], including toggling tasks and progress counts.

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: noctalia v5.0.0 (5.0.0_beta.10-1-dirty)
• Plugin API level: 24

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the README template, documents every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• thumbnail.webp is present and relevant; for a new plugin I created it with the thumbnail generator, and for an update I regenerated it with the generator if the visual identity or user-facing appearance changed.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[github-actions]

The description now contains the required template structure.

[ItsLemmy]

1. non-blocking - sticky-notes/panel.luau:394-397

When blurred is true, each note card still renders its full action row beneath
the blur overlay. A note containing an http/https/www link gets the
external-link button (panel.luau:394-397) unconditionally: hovering it shows
the note's exact URL via the panel.open-link tooltip (panel.luau:396) and
clicking it opens that URL in the browser (panel.luau:397). Only the card body
click (panel.luau:359) and the pencil edit button (panel.luau:407) are gated on
blur; the link derivation at panel.luau:280 runs regardless.

Impact: contradicts the plugin's own documentation claim at
sticky-notes/README.md:62-63 that blur mode "disables opening note links until
you reveal the notes again", and weakens the advertised privacy blur: a hidden
note's link presence and full URL remain discoverable, and the link can still
be opened. Suggested fix: suppress the link button while blurred (treat webLink
as nil when blurred, or gate the button with enabled = not blurred) so behavior
matches the documented privacy promise.

[Ahmedhossamdev]

Hey @ItsLemmy
Done: #654