Fix: require_active_plugin without get_current_user dependency — auth handled by individual routes

app/deps.py

@@ -232,11 +232,12 @@ def require_active_plugin(plugin_name: str):
     Returns 403 if the plugin is not active in the permission registry.
     This allows routes to be registered at app creation time while
     enforcing activation status at request time.
+
+    Note: Does NOT depend on get_current_user — individual route handlers
+    already have their own auth dependencies (require_permission, etc.).
+    This check only verifies plugin activation status.
     """
-    async def _check(
-        request: Request,
-        current_user: dict[str, Any] = Depends(get_current_user),
-    ) -> dict[str, Any]:
+    async def _check() -> None:
         from app.core.permission_registry import get_permission_registry
         try:
             registry = get_permission_registry()
@@ -253,6 +254,5 @@ def require_active_plugin(plugin_name: str):
         except Exception:
             # If registry not initialized yet, allow request (startup race)
             pass
-        return current_user
 
     return _check