offscale is a plugin

headscale leaves the platform. 45 files move to plugins/offscale/ and the
platform stops knowing it exists.

  api/router.ts   the thin auth-gated proxy, now at /api/offscale
  sidecar/        18 files, the whole headscale contract and its admin keys
  db/             schema + queries, offscale_servers
  web/            26 files as panels and a layout — no screen, per the rule

removed from the platform: the hono mount, the `headscale` capability, the
App.tsx route pair, the screen and its barrel, the AppRegistry spread, the
officerdev re-exports, the dock tile, the page-title rule, and both database
barrels. tsgo is clean and nothing references it.

the imports tell the story of what the plugin↔host API actually is. the sidecar
takes @@/sidecar/protocol, @@/sidecar/connect, @@/data-path and
@@/officer-url.mjs; the queries take officerdb/db and officerdb/crypto; the
schema takes officerdb/auth/schema for the one reference a plugin may make; the
web half takes useClient, copyToClipboard, WorkspaceView and TerminalView from
the officerdev barrel. all of it resolves because a plugin lives inside the repo
— no publishing, no version negotiation.

AND IT FOUND A REAL BUG IN THE INSTALLER. createSidecarProxy learns its port
from a one-shot `<name>:server` event and subscribes when the plugin's router is
first imported — at mount. install started the sidecar BEFORE mounting, so the
announcement fired into a void: process online, routes mounted, every request
answering `503 sidecar not available` until something forced a reconnect. it
would have hit every plugin with an http sidecar. `example` never caught it
because it has no listener to announce.

install and enable now mount before starting; disable still unmounts before
stopping. neither direction leaves a mounted route in front of a sidecar that
cannot be reached.

verified live: /api/offscale/_officer/servers answers {"servers":[]}, /offscale
and /offscale/nodes serve, the old /api/headscale is 404, the offscale
capability is registered from the manifest, and officer-offscale is online.

757 pass, same 10 pre-existing failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

plugins/offscale/web/useHeadscaleInvites.ts

@@ -0,0 +1,59 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useClient } from 'hooks/useClient';
+import type { HeadscaleInviteCreated, InviteCreateInput, InviteCreateResult, InvitesListResult } from './shared';
+
+// Device invites for the active server. Everything goes through the headscale sidecar, which proxies the
+// server's own companion — see src/servers/sidecar/headscale/invites.ts for why the records live there and
+// not here.
+//
+// The create result is deliberately NOT merged into the list cache. It is the one response that contains the
+// claim link, and a cache is a place things persist: the view keeps it in component state, shows it once and
+// drops it. The list is refetched instead, which returns the same invite without its token.
+
+const BASE = '/offscale/_officer/enroll/invites';
+const INVITES_KEY = ['headscale', 'invites'] as const;
+
+const EMPTY: InvitesListResult = { available: true, invites: [] };
+
+export function useHeadscaleInvites() {
+  const { get, post, delete: del } = useClient();
+  const qc = useQueryClient();
+  const invalidate = () => qc.invalidateQueries({ queryKey: INVITES_KEY });
+
+  const query = useQuery({
+    queryKey: INVITES_KEY,
+    queryFn: () => get<InvitesListResult>(BASE),
+    // A pending invite expires on a clock, so a list left open goes wrong on its own. Cheap: one companion
+    // call against a table with a handful of rows.
+    refetchInterval: 30_000,
+    staleTime: 10_000,
+  });
+
+  const create = useMutation({
+    mutationFn: async (input: InviteCreateInput): Promise<HeadscaleInviteCreated> => {
+      const result = await post<InviteCreateResult>(BASE, input);
+      // An unavailable companion is a 200 here, like every companion route — turn it into a rejection so the
+      // form shows it where the admin is looking rather than rendering an empty link panel.
+      if (!result.available) throw new Error(result.reason);
+      return result.invite;
+    },
+    onSuccess: invalidate,
+  });
+
+  const revoke = useMutation({
+    mutationFn: (id: string) => del(`${BASE}/${encodeURIComponent(id)}`),
+    onSuccess: invalidate,
+  });
+
+  const result = query.data ?? EMPTY;
+
+  return {
+    invites: result.available ? result.invites : [],
+    /** Set when this server has no enrolment API — a state to explain, not an error. */
+    unavailable: result.available ? null : result.reason,
+    isLoading: query.isLoading,
+    error: query.error,
+    create,
+    revoke,
+  };
+}