Network: opt-in through an extended option, off by default

[epeicher]

What it does

The OpenStation Network becomes opt-in. A new Enable OpenStation Network toggle in OpenStation Preferences → Features → Extended options, off by default, decides whether the network module loads at all. While it is off, the Network app is not in the dock, nothing network-related runs on the server, and a multisite keeps the site switcher it already has on its own.

Rationale

The module (#756, #782) loaded on every install, whether or not the site was part of a network: a keypair minted on first use, three REST routes, a cron hook, the hop redeem on init, and the Network window in every dock. Most installs will never pair with another, and the pattern for that already exists in this codebase: games and AI agents are gated by an extended option and cost nothing while off.

Implementation

Mirrors includes/games/bootstrap.php exactly:

• includes/network/bootstrap.php reads the network key of the extended options bundle (openstation_network_enabled(), filter openstation_network_enabled) and, on plugins_loaded priority 5, requires the six module files only when it is on. desktop-mode.php requires the bootstrap instead of the files.
• apps/network/network.os.php returns null before defining the app when the module is off, so the registry takes no window.
• The three callers outside the module are guarded: openstation_multisite_payload() returns null for a single site while off (no network, no switcher), the member entries and hopUrl are added only while on, and hopLinkOffer in the shell config is null without the module.

function openstation_network_load() {
	if ( ! openstation_network_enabled() ) {
		return;
	}
	require_once OPENSTATION_DIR . 'includes/network/keys.php';
	// …identity, registry, hub, member, hop
}
add_action( 'plugins_loaded', 'openstation_network_load', 5 );

The toggle spends the same $os->refresh_menu() the other extended options do, so the Network tile appears and disappears without a reload. Pairings, keys and links are options and user meta that survive a disable and are back when the option is on again.

Behaviour change for installs already paired on #782: after this lands the network is off until an administrator turns it on, on each install.

Testing instructions

1. Fresh install: no Network tile in the dock, GET /wp-json/desktop-mode/v1/network/identity answers rest_no_route, and on a single site Overview has no site switcher.
2. OpenStation Preferences → Features → Extended options → Enable OpenStation Network: the Network tile appears in the dock at once; the identity route answers; on a multisite the switcher is unchanged.
3. Turn it off again: the tile goes, the route is gone. Turn it on: any pairing made before is still there.

Gates: npm run build && npm run lint && npm run typecheck && npm run test:js, then npm run env:start:tests && npm run lint:php && npm run test:php && npm run test:php:multisite && npm run env:stop:tests. test_the_network_is_off_by_default_and_its_option_turns_it_on pins the default and the payload guards on both shapes; the PHPUnit bootstrap enables the network for the rest of the suite, the way it does for games and agents.