User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/editor/plugins/loader.ts

@@ -136,6 +136,20 @@ export class PluginManager {
     });
   }
 
+  /**
+   * Deactivates everything that is running, without touching the switches on the server: the
+   * editor is going away (signing out, #177) and every plugin has to let go of it first. A later
+   * editor starts them again from the same files.
+   */
+  stopAll(): Promise<void> {
+    return this.enqueue(async () => {
+      for (const file of [...this.loaded.keys()]) this.deactivate(file);
+      this.started = false;
+      this.changed();
+      await Promise.resolve();
+    });
+  }
+
   /** Switches a plugin on or off: stored on the server first, and only then applied. */
   setActive(file: string, active: boolean): Promise<void> {
     return this.enqueue(async () => {