installing a plugin pins its dock tile, with no reload

Installing Music left the dock unchanged. The tile existed server-side the
moment the plugin was enabled, and the only way to see it was Profile → Dock,
by hand, after a page refresh. Installing something is already the decision to
use it; saying so twice is the bug.

Three separate causes, which is why it looked like one stubborn one:

1. `dock_configs.paths` is a COMPLETE ordered list, not a diff — useDock renders
   the saved list rather than everything available, so anything not named in it
   is invisible. Nothing in the plugin system had ever written to that table.
   installPlugin now appends the new route, for the caller (threaded through the
   route) rather than a guessed owner id.

   Only for a user who HAS a row. A user without one is left alone deliberately:
   there is nothing to append to, and writing one would freeze today's defaults
   into their account permanently. That case is (2).

2. The fallback for a user who never customised was DEFAULT_DOCK_PATHS, which is
   core-only — so a plugin tile was hidden there too. `defaultDockPaths(plugins)`
   is now that list plus a tile per installed plugin, and the dock and its
   settings screen both call it so they cannot disagree about what "default"
   means.

3. useDock holds ['DOCK'] at staleTime: Infinity and the plugin verbs invalidated
   only ['plugins'] and ['self-permissions']. So even once the server wrote the
   path, nothing asked again — that is the part that made a reload necessary.

Also fixes a guard I broke reaching for this: typing VERBS as
Record<string, VerbFn> widens keyof to `string`, which makes `isVerb` prove
nothing and lets an unknown verb index the map. `satisfies` instead, and there is
now a check that Verb is still the four-member union.

Uninstall deliberately does not remove the path. A stale path with no item behind
it is dropped by useDock, and keeping it means disable/enable and reinstall put
the tile back where the user had it rather than at the end.

tsgo clean, frontend builds. 787 pass / 7 fail — 6 identical to before; the 7th
is plugins/music/cliamp, which install pulled into test discovery and which the
manifest documents as parked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/plugins/router.ts

@@ -153,7 +153,7 @@ pluginsRouter.get('/', async (ctx) => {
  * the one worth reading. See `plugins/install.ts` for why the order inside each is what it is.
  */
 pluginsRouter.post('/:appName/install', async (ctx) => {
-  const result = await installPlugin(ctx.req.param('appName'));
+  const result = await installPlugin(ctx.req.param('appName'), undefined, ctx.get('user').id);
   return ctx.json(result, result.ok ? 200 : 400);
 });
 
@@ -183,12 +183,18 @@ pluginsRouter.post('/:appName/disable', async (ctx) => {
 // routes are owner-only. The client reads the body and parses frames itself, which is exactly what
 // `useCompanionLogStream` already does for the headscale container logs.
 
+// `userId` is the caller, threaded through so install can pin the new tile to THEIR dock rather than
+// guessing at the owner. Only install uses it; the others take it and ignore it so the map stays one shape.
+type VerbFn = (appName: string, onStep: (s: string) => Promise<void>, userId: number) => Promise<PluginActionResult>;
+
 const VERBS = {
-  install: (appName: string, onStep: (s: string) => Promise<void>) => installPlugin(appName, onStep),
-  uninstall: (appName: string, onStep: (s: string) => Promise<void>) => uninstallPlugin(appName, onStep),
-  enable: (appName: string, onStep: (s: string) => Promise<void>) => setPluginRunning(appName, true, onStep),
-  disable: (appName: string, onStep: (s: string) => Promise<void>) => setPluginRunning(appName, false, onStep),
-} as const;
+  install: (appName, onStep, userId) => installPlugin(appName, onStep, userId),
+  uninstall: (appName, onStep) => uninstallPlugin(appName, onStep),
+  enable: (appName, onStep) => setPluginRunning(appName, true, onStep),
+  disable: (appName, onStep) => setPluginRunning(appName, false, onStep),
+  // `satisfies` rather than an annotation: an annotation would widen the keys to `string`, which turns
+  // `isVerb` into a guard that proves nothing and lets an unknown verb index the map.
+} satisfies Record<string, VerbFn>;
 
 type Verb = keyof typeof VERBS;
 const isVerb = (v: string): v is Verb => v in VERBS;
@@ -197,6 +203,8 @@ pluginsRouter.post('/:appName/:verb/stream', async (ctx) => {
   const appName = ctx.req.param('appName');
   const verb = ctx.req.param('verb');
   if (!isVerb(verb)) throw errors.NOT_FOUND(`Unknown action: ${verb}`);
+  // Read before the stream opens: once we are inside ReadableStream.start the request context is gone.
+  const userId = ctx.get('user').id;
 
   const encoder = new TextEncoder();
   const frame = (event: string, data: unknown) => encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
@@ -215,7 +223,7 @@ pluginsRouter.post('/:appName/:verb/stream', async (ctx) => {
 
       let result: PluginActionResult;
       try {
-        result = await VERBS[verb](appName, async (step) => send('step', { step }));
+        result = await VERBS[verb](appName, async (step) => send('step', { step }), userId);
       } catch (err) {
         result = { ok: false, appName, steps: [], error: err instanceof Error ? err.message : String(err) };
       }