fix(plugins): treat a same-version upload as a reinstall, not a first install

[mostafasadeghidev]

Re-uploading a plugin at an unchanged version number falls through both semver guards — semverGt false, semverLt false — and lands in installFreshFromPackage, the path written for a plugin that is not there.

On a live install that means:

• the running version's deactivate never runs
• install runs a second time on an already-installed plugin
• migrate is skipped
• there is no rollback if a hook throws, so a failure returns 201 with the plugin parked in error and its assets already overwritten
• the audit event says plugin.install, recording a replacement as a first-time install

Rebuilding a package without bumping the version is the normal inner loop of plugin development, so this is the path a developer hits most often.

The fix

A lower version already returns above, so anything reaching the branch is installed at the same version or higher — existing alone now selects the upgrade path.

That surfaced two places where "old version" and "new version" name the same directory, and both would have deleted a working plugin:

Step 6 — drop the old version's assets after a successful upgrade	with equal versions, that is the directory step 2 just wrote
rollbackUpgrade — drop the new version's assets on failure	with equal versions, that is the only copy, and the restored row still points at it

Both are now guarded on the versions actually differing. The new test fails without either guard.

The dialog was silent too

It only set upgradeFromVersion when the versions differed, so a reinstall rendered the first-install screen: no mention of the plugin already being there, and every permission badged "new" though all were already approved.

It now carries the installed version whenever there is one, and distinguishes three cases:

• Reinstall — "Version 1.6.1 is already installed. Reinstalling replaces its files in place…"
• Update — unchanged
• Downgrade — previously promised "settings and stored data are preserved; the plugin runs its migrate hook" and was then refused by the server. It now says so before the operator commits, and the confirm button is disabled rather than buying them a round trip and an error banner.

bun test src/__tests__/server/cmsPlugins.test.ts   23 pass, 0 fail
bun test src/__tests__/plugins/                   174 pass, 0 fail
tsc -b, eslint                                    clean

Co-Authored-By: Claude Opus 5 noreply@anthropic.com