Root location: an absolute path, with a picker that can make folders

defaults to `<owner home>/fofos`, and stores the FULL path — never the tilde. a
tilde means "whoever is asking", and the people asking will not all be the same
person: this plugin is grantable, and the site is in one place regardless of who
is looking at it. stored as `~/fofos` it would give every user a different answer
to a question that has one.

THE DEFAULT IS COMPUTED, NOT WRITTEN. no row means the default is worked out on
every read, so it follows the machine. writing it in at install freezes whichever
home existed on install day, and a restore onto a different machine then points at
a directory that is not there while looking deliberately chosen. a saved path is a
decision and is stored exactly as given; only its absence is derived. the form
says which of the two it is showing, because "not set" reading identically to "set
to the default" is how somebody comes to believe they configured something they
did not.

THE PICKER USES THE PLATFORM'S FILE API — /file-browser/ls and /mkdir — not routes
of this plugin's own. they already refuse to leave home, and they already tell a
missing directory from a forbidden one, which is a distinction that cost somebody
an afternoon and would have been re-guessed here. shipping a second listing and
mkdir would be a second filesystem surface to audit for the sake of one form.

that API is an execution capability and never grantable, so for anybody but the
owner it 403s — said in a sentence rather than shown as an empty tree, because an
empty listing is data and must never be how a refusal looks. it also browses the
owner's home and nothing above it; a path outside home is still reachable by
typing, since the picker fills the field and the FIELD is what saves. one value on
screen, one Save, and picking a folder commits nothing by itself.

"Use this folder" takes the one that is OPEN rather than one highlighted in the
list. that makes looking inside and choosing one gesture, and it is the only way
to choose a folder with nothing in it — which a freshly made one always is.

a SECOND table, not a column on fofos_admin_connection, whose url and token are
both notNull: a root path could not be saved there without also having an HTTP
connection, and that connection is being replaced rather than extended. when it
goes, its table is a clean drop instead of surgery on columns that outlived it.
the rule against tables in this plugin is unbent — what it forbids is the CLIENT'S
work, and this row holds a path somebody can retype.

needs `bun db:push`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/router.ts

@@ -2,6 +2,7 @@ import type { Context } from 'hono';
 import { createRouter, type HonoVariables } from '@@/create-router';
 import { registerProxiedPrefix } from '@@/sidecar/proxied-prefixes';
 import { deleteConnection, readConnection, readCredentials, recordProbe, saveConnection } from './connection';
+import { readSettings, saveRootPath, clearRootPath } from './settings';
 import { fofosRequest, FofosError, probe, type FofosResponse } from './fofos-client';
 
 /**
@@ -153,6 +154,37 @@ router.post('/_config/test', async (ctx) => {
   return ctx.json(result);
 });
 
+/**
+ * Where the fofos site is on this machine.
+ *
+ * Under `/_config`, so the manifest's `ownerOnly: ['/_config']` covers it with no second rule to keep
+ * in step. That is the right level: this path is what the plugin will read and write the client's
+ * site through, so choosing it is an owner's decision even though editing the site is not.
+ *
+ * The caller's email only ever reaches `getOwnerHomeDir`, which ignores it and answers with the
+ * OWNER's home. That is deliberate rather than sloppy — see `api/settings.ts`.
+ */
+router.get('/_config/root', async (ctx) => {
+  const user = ctx.get('user');
+  return ctx.json(await readSettings(user.email));
+});
+
+router.put('/_config/root', async (ctx) => {
+  const user = ctx.get('user');
+  const { path } = (ctx.get('body') ?? {}) as { path?: string };
+  try {
+    return ctx.json(await saveRootPath(path ?? '', user.email));
+  } catch (error) {
+    // The only failures here are the caller's own words being unusable, which is a 400 and not a fault.
+    return ctx.json({ error: (error as Error).message }, 400);
+  }
+});
+
+router.delete('/_config/root', async (ctx) => {
+  const user = ctx.get('user');
+  return ctx.json(await clearRootPath(user.email));
+});
+
 /**
  * Is this plugin usable? Asked once by the detail panel rather than by all nine sections.
  *