Fix plugin security, hooks system, and admin features

- Add plugin allowlist (enabled_plugins in config.json)
- Add enable/disable toggle in admin (separate from visibility)
- Add plugin hooks system (actions + filters with auto-registration)
- Fix autoLinkPageTitles nested <a> tag vulnerability
- Move MQTT credentials to environment variables
- Preserve current page in language switcher
- Fix ctime/birthtime for file creation date
- Deduplicate getGuidePage() CommonMark setup
- Simplify formatDisplayName() logic
- Add admin activity log to dashboard
- Add own password change with current password verification
- Apply theme header_color to admin sidebar
- Add content preview button in editor

admin/src/AdminAuth.php

@@ -211,6 +211,29 @@ class AdminAuth
         return ['success' => false, 'message' => 'Gebruiker niet gevonden.'];
     }
 
+    public function changeOwnPassword(string $username, string $currentPassword, string $newPassword): array
+    {
+        $user = $this->findUser($username);
+        if (!$user) {
+            return ['success' => false, 'message' => 'Gebruiker niet gevonden.'];
+        }
+        if (!password_verify($currentPassword, $user['password_hash'])) {
+            return ['success' => false, 'message' => 'Huidig wachtwoord is onjuist.'];
+        }
+        if (strlen($newPassword) < 8) {
+            return ['success' => false, 'message' => 'Nieuw wachtwoord moet minimaal 8 tekens zijn.'];
+        }
+        foreach ($this->adminConfig['users'] as &$u) {
+            if ($u['username'] === $username) {
+                $u['password_hash'] = password_hash($newPassword, PASSWORD_DEFAULT);
+                $this->saveAdminConfig();
+                $this->log('info', "Eigen wachtwoord gewijzigd: {$username}");
+                return ['success' => true, 'message' => 'Wachtwoord gewijzigd.'];
+            }
+        }
+        return ['success' => false, 'message' => 'Fout bij wijzigen wachtwoord.'];
+    }
+
     // --- Private helpers ---
 
     private function findUser(string $username): ?array