User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/editor/plugins.test.ts

@@ -349,6 +349,25 @@ describe('switching a plugin on and off', () => {
     expect(manager.records[0]).toMatchObject({ status: 'active', meta: { name: 'Plugin demo' } });
   });
 
+  it('signing out stops every plugin without touching the switches on the server', async () => {
+    const log: string[] = [];
+    const { manager, start, state, tabs, stored } = switchable({
+      'a.js': () => tabPlugin('a', log),
+      'b.js': () => tabPlugin('b', log),
+      'off.js': () => tabPlugin('off', log),
+    });
+    await start();
+    expect(tabs.size).toBe(3);
+
+    await manager.stopAll();
+    expect(log).toEqual(['a: deactivate', 'b: deactivate', 'off: deactivate']);
+    expect(tabs.size).toBe(0);
+    // The switches are the account's, not this editor's: nothing was written (#177).
+    expect(stored).toEqual([]);
+    state.execute(new CreateAssetCommand('sprite', 'Crate'));
+    expect(log).toEqual(['a: deactivate', 'b: deactivate', 'off: deactivate']);
+  });
+
   it('switching off runs deactivate and takes the tab and the listeners with it', async () => {
     const log: string[] = [];
     const { manager, start, state, tabs, stored } = switchable({ 'demo.js': () => tabPlugin('demo', log) });