fix(sync): apply exclusion filter to gist-sync plugin export path (#47)

[kipavy]

Fixes #47.

Problem

Per-object / per-type sync exclusion (cloud-off) was enforced only on the built-in server push (fixed in #43). The gist-sync plugin export path called backup_export without the excluded_ids argument:

// src/plugins/runtime.ts — exportState (before)
const blob = await invoke("backup_export", { encKey, accountId: "gist-sync", deviceId });

Because the Rust param is Option<Vec<String>>, an absent argument deserializes to None, so strip_excluded early-returns and the blob contains every object — including ones marked cloud-off, along with their secret material (passwords, private keys). For a user relying on gist-sync, an excluded Host/Identity/SSH Key still leaves the device.

Fix

• Export the existing getExcludedObjectIds() helper from src/services/sync.ts (was file-private).
• Thread it into the plugin runtime's exportState → backup_export invoke, mirroring the built-in server push().

Excluding an object now keeps it off every sync destination, not just the built-in server. Both backup_export call sites in the codebase supply the filter; no other plugin export paths were missing it.

Tests

• New src/plugins/runtime.exportState.test.ts asserts exportState forwards the excluded-id set into backup_export (red before the fix, green after).
• tsc --noEmit clean; existing sync + plugin suites pass (36 tests, no regressions).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RnVt37SuhKfm94kpkh8rez