Plugins are switched on and off in a Plugins tab, the server keeps the state in data/plugins/plugins.json, and switched-off plugins are never delivered (#114)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/index.php

@@ -25,8 +25,9 @@ declare(strict_types=1);
  *   POST   ?r=sounds&name=x.wav   raw sound bytes    → {file,name,bytes}
  *   DELETE ?r=sounds/{file}       → 204
  *
- *   GET    ?r=plugins             → [{file,bytes,updatedAt}], sorted by file name
- *   GET    ?r=plugins/{file}      → the module source as text/javascript
+ *   GET    ?r=plugins             → [{file,bytes,updatedAt,active}], sorted by file name
+ *   GET    ?r=plugins/{file}      → the module source as text/javascript | 403 while switched off
+ *   PUT    ?r=plugins/{file}      {active}             → {file,bytes,updatedAt,active}
  *
  * `name` is the file's original name, kept beside it as `{file}.json` (see OriginalName) and
  * empty when none is known. It is a caption, never a path: the stored file is always `{hash}.{ext}`.
@@ -220,19 +221,38 @@ function routeSounds(array $parts, string $method): never
 /** @param list<string> $parts */
 function routePlugins(array $parts, string $method): never
 {
-    if ($method !== 'GET') {
-        Response::error('Method not allowed', 405);
-    }
     $store = new PluginStore(dirname(__DIR__) . '/data/plugins');
 
     if (count($parts) === 1) {
+        if ($method !== 'GET') {
+            Response::error('Method not allowed', 405);
+        }
         Response::json($store->list());
     }
 
+    if ($method === 'PUT') {
+        $active = Response::body()['active'] ?? null;
+        if (!is_bool($active)) {
+            Response::error('active must be true or false', 422);
+        }
+        $entry = $store->setActive($parts[1], $active);
+        if ($entry === null) {
+            Response::error('Plugin not found', 404);
+        }
+        Response::json($entry);
+    }
+    if ($method !== 'GET') {
+        Response::error('Method not allowed', 405);
+    }
+
     $source = $store->read($parts[1]);
     if ($source === null) {
         Response::error('Plugin not found', 404);
     }
+    // Switched off means not run: the editor never asks for such a module, and nobody else may.
+    if (!$store->isActive($parts[1])) {
+        Response::error('Plugin not active', 403);
+    }
     header('Content-Type: text/javascript; charset=utf-8');
     header('X-Content-Type-Options: nosniff');
     // A replaced file has to be the one the next editor start runs.