fix: send credentials to the plugin endpoints so backend switching works

[fatherlinux]

Fixes the report that "the Google Drive checkbox is stuck on and the pCloud checkbox won't check."

Root cause — predates the pCloud plugin

The storage backend is a per-user choice the server resolves from the request credentials (spec 007). But every frontend call to /api/plugins and /api/plugins/toggle used a bare fetch() with no credentials attached, so the server could not tell who was asking:

• GET /api/plugins fell back to DEFAULT_STORAGE_BACKEND → JSON on Google Drive rendered active for everyone, regardless of their real choice.
• POST /api/plugins/toggle returned 401 for any storage plugin, and togglePlugin silently reverted the checkbox → no storage backend could be selected from the UI at all.

Reproduced against production before the fix:

$ curl -s https://acquacotta.crunchtools.com/api/plugins | jq -r .active_storage
json-google-drive          # regardless of caller

$ curl -s -X POST .../api/plugins/toggle -d '{"plugin_id":"json-pcloud",...}'
{"error":"Not authenticated"}   HTTP 401

Switching to Sheets was equally broken. pCloud was just the first backend switch anyone attempted since spec 007 landed.

Fix

pluginFetch() in storage.js attaches credentials when present. Unlike authenticatedFetch it deliberately does not require a storage location — switching backends is precisely the moment the new backend has none yet — and it stays usable logged out, which the pre-login settings view renders. All 9 call sites converted.

Two UI fixes for the same report:

• A failed toggle now reports why instead of silently snapping back. The silence is why this looked like "the checkbox won't check" rather than an error.
• Toggling pCloud on now starts the OAuth link instead of recording a backend the browser has no token for. Linking is the switch — its callback already records the backend.

Testing

• 4 new server tests pinning the contract: the list reports the caller's own backend, the toggle succeeds with credentials and 401s without, and one user's switch doesn't move another's.
• 273 tests pass; ruff 0.16.1 check + format clean; node --check on storage.js.

Note the new tests pin the server contract, which was already correct — the defect was client-side. They guard against the endpoints silently losing per-user resolution, but the client wiring itself is verified by manual retest in production.

🤖 Generated with Claude Code

https://claude.ai/code/session_011RYAzzVJJqrsp6TkeRS4vX

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

Gatehouse found no issues.