Per-site disable should fully stop injection (currently still intercepts fetches) #4

Problem

Toggling Podkey off for a specific site (solid.social / solid-apps.github.io) does not stop the NIP-98 auto-injection. The console still shows [Podkey] ✅ Added NIP-98 auth header on outgoing fetches from pilot, and the NIP-98 signature overrides the active Solid-OIDC session — causing 403s when the user writes to their own pod.

Full disable of the extension (or incognito without it loaded) is the only reliable way to stop injection.

Expected

When Podkey is toggled off for the current site, no auth headers should be added and window.nostr provider should not be injected on that origin.

Impact

Podkey effectively breaks Solid-OIDC on any JSS pod while enabled, because the NIP-98 header it injects uses a key not linked to the user's WebID. JSS's ACL grants access to the WebID, server sees did:nostr:<random-podkey-key>, denies the request.

Related — filed a defensive JSS-side fix at JavaScriptSolidServer/JavaScriptSolidServer#306 (prefer OIDC when both present). But Podkey should also respect per-site disable.

Reproduction

1. Log into solid.social via pilot (Solid-OIDC flow succeeds)
2. Try to edit profile → PUT 403 Forbidden
3. Check console — Podkey still shows ✅ Added NIP-98 auth header despite being toggled off for the site
4. Fully disable Podkey (or use incognito) → PUT succeeds

Observed with Podkey intercepting every outgoing fetch including ones that already have a valid DPoP token.