feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling

src/backend/database/routes/users.ts

@@ -8,6 +8,7 @@ import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
 import { parseUserAgent } from "../../utils/user-agent-parser.js";
 import { deleteUserAndRelatedData } from "./delete-user-data.js";
 import {
+  allowsDesktopAutoSession,
   isLoopbackRequest,
   extractBearerOrCookieToken,
   isNativeTokenExportRequest,
@@ -545,6 +546,30 @@ router.post("/logout", authenticateJWT, async (req, res) => {
   }
 });
 
+/**
+ * On a desktop linked to a server, the account it is signed in to there.
+ * That account is who the user is; the local profile only mirrors it.
+ */
+async function describeDesktopLink(userId: string) {
+  if (process.env.ELECTRON_EMBEDDED !== "true") return null;
+  try {
+    const { getLink } = await import("../../sync/client/link-store.js");
+    const link = await getLink();
+    if (!link || link.userId !== userId) return null;
+    return {
+      serverUrl: link.serverUrl,
+      serverName: link.serverName,
+      username: link.account?.username ?? link.remoteUsername,
+      isAdmin: !!link.account?.isAdmin,
+      roles: link.account?.roles ?? [],
+      permissions: link.account?.permissions ?? [],
+      status: link.status,
+    };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * @openapi
  * /users/me:
@@ -595,6 +620,7 @@ router.get("/me", authenticateJWT, async (req: Request, res: Response) => {
         user.id,
       ),
       show_donation_modal: showDonationModal,
+      linked: await describeDesktopLink(user.id),
     });
   } catch (err) {
     authLogger.error("Failed to get username", err);
@@ -728,7 +754,7 @@ router.get("/setup-required", async (req, res) => {
  */
 router.post("/internal/auto-session", async (req, res) => {
   try {
-    if (!isLoopbackRequest(req)) {
+    if (!allowsDesktopAutoSession() || !isLoopbackRequest(req)) {
       authLogger.warn(
         "Rejected non-loopback attempt to access auto-session endpoint",
         { source: req.ip },