[BUG] Sync exclusion not applied to the gist-sync plugin export path

[kipavy]

Summary

Per-object / per-type sync exclusion is now enforced on the built-in server sync path (fixed in #43), but the gist-sync plugin export path is not filtered: it uploads excluded objects — entity JSON and their secret material — to the user's GitHub gist anyway.

Mechanism

#43 added an excluded_ids: Option<Vec<String>> parameter to the backup_export Tauri command; the server-sync push() in src/services/sync.ts now passes the resolved excluded-id set so excluded entities and their secrets are stripped before encryption.

The plugin runtime calls the same command without that argument:

// src/plugins/runtime.ts:811 (exportState)
const blob: number[] = await invoke("backup_export", {
  encKey: encKeyBytes,
  accountId: "gist-sync",
  deviceId,
  // no excludedIds → Option defaults to None → strip_excluded is a no-op
});

Because excluded_ids is Option, an absent argument deserializes to None, so strip_excluded early-returns and the blob contains every object — including ones the user marked cloud-off. For a user relying on the gist-sync plugin, an excluded Host/Identity/SSH Key (and its password / private key) still leaves the device.

Expected

Excluding an object should keep it off every sync destination, not just the built-in server. Either:

• pass getExcludedObjectIds() (from src/services/sync.ts) into the plugin's exportState → backup_export invoke, so the same filter applies; or
• if plugin sync is intentionally exempt, make that explicit in the UI (e.g. a note on the exclusion toggle that third-party sync plugins are not covered), so the cloud-off badge doesn't over-promise.

Notes

• Discovered during the [BUG] Per-object sync exclusion doesn't withhold the object from the blob (only gates the push trigger) #43 final review. [BUG] Per-object sync exclusion doesn't withhold the object from the blob (only gates the push trigger) #43 deliberately scoped itself to the built-in server sync path; this is the tracked follow-up for the plugin path.
• The filtering primitives already exist and are reusable: getExcludedObjectIds() (src/services/sync.ts) and the Rust strip_excluded inside backup_export — the plugin path just needs to supply the id set.

[kipavy]

Fix up in #48 (targets dev, where #43's exclusion work currently lives).

Exported getExcludedObjectIds() from src/services/sync.ts and threaded it into the plugin runtime's exportState → backup_export invoke, mirroring the built-in server push(). Excluded (cloud-off) objects and their secret material are now stripped from the gist-sync export path too — both backup_export call sites supply the filter. Added a runtime test asserting the excluded-id set is forwarded.