fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own (#1632)

* fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own

* fix(sync): switch off an untrusted mirrored plugin when the server updates it

* fix: require local consent for mirrored plugin activation

* docs: describe consent fields on the plugin state endpoint

src/ui/plugins/PluginDetail.tsx

@@ -177,7 +177,7 @@ export function PluginDetail({
               <Button
                 variant="outline"
                 size="sm"
-                disabled={busy || locked}
+                disabled={busy || plugin.managedByServer}
                 onClick={() => void manager.toggle(plugin)}
               >
                 {plugin.enabled