fix(sync): sync WebDAV server URL for configured-but-disabled providers (#5141)

[chrox]

Fixes #5141.

Problem

Two issues from the report:

1. Server URL not synced. When a WebDAV server was configured but not enabled, the username and password synced to other devices but the server address did not, so the peer received half a config and could not reconnect.
2. E-ink checkbox invisible. On e-ink the enable checkbox for a configured-but-disabled cloud sync provider was not prominent enough.

Root cause (sync)

In replicaSettingsSync.ts, plaintext and encrypted whitelisted settings used two different "was this already published?" trackers, and they diverge:

• Plaintext webdav.serverUrl / rootPath diff against an in-memory snapshot that initSettingsSync seeds from disk at boot, so any value already on disk is treated as already-published and never sent again unless it changes.
• Encrypted webdav.username / password use a persisted push-hash, so a value with no stored hash is treated as never-published and is sent on the next save.

When WebDAV was configured before webdav.* entered the sync whitelist (#4810) — or before localStorage recorded a push — the boot seeding stranded serverUrl / rootPath while the credentials synced normally. The peer received username/password but not the server address, exactly as reported. A fresh Connect always worked because there the URL goes from empty to set while the app runs, so it diffs.

Fix

• Track credential connection metadata (webdav.serverUrl / rootPath plus the kosync/readwise/s3 equivalents, derived as "whitelisted, not encrypted, sharing a top-level group with an encrypted field") with the same persisted push-hash as the encrypted fields instead of the disk-seeded snapshot. A never-published URL now publishes on the next save and rejoins its credentials. Empty values stay local, mirroring the encrypted-field rule. Structural settings keep their disk-seeded clobber protection.
• Give DaisyUI .checkbox a crisp 1px base-content border in e-ink mode so a configured-but-disabled provider's enable box stays visible on grayscale panels. Scoped to .checkbox so the .toggle switch keeps its own treatment (eink-bordered is wrong here — its forced base-100 background would wipe the checked fill).

Tests

• Added a failing test first that reproduced the stranded URL (credentials publish, serverUrl does not), now passing.
• Rewrote one existing test whose fixture had encoded the buggy behavior (it used a disk-configured kosync.serverUrl to assert no-push) to instead assert that only structural fields stay out of the diff and that connection metadata is exempt from disk-seed priming.

Verification

• pnpm test — 7565 passed / 9 skipped
• pnpm lint (tsgo + Biome) — clean

🤖 Generated with Claude Code