Fix plugin order: SetupPlugin must load before AuthPlugin

AuthPlugin's init() method tries to contribute menu items to the setupNav service,
which is only registered after SetupPlugin's init() runs. The previous order had
AuthPlugin loading first, causing it to silently fail when trying to contribute
navigation items.

Correct order:
1. SetupPlugin (registers setupNav service in init phase)
2. AuthPlugin (contributes to setupNav in init phase)

This ensures the Setup App menu is populated with auth-related items:
- Users
- Organizations
- Teams
- API Keys
- Sessions

Agent-Logs-Url: https://github.com/objectstack-ai/objectui/sessions/07edc3ef-a3a9-4926-bd1a-db0c2513b862

Co-authored-by: xuyushun441-sys <255036401+xuyushun441-sys@users.noreply.github.com>

Author: Claude

apps/console/objectstack.config.ts

@@ -77,22 +77,22 @@ class MemoryI18nPlugin {
  * MemoryI18nPlugin MUST come before AppPlugin so that the i18n service
  * exists when AppPlugin.start() → loadTranslations() runs.
  *
- * AuthPlugin before SetupPlugin: both use namespace 'sys', and the
- * ObjectQL registry requires the package that owns objects (AuthPlugin →
- * com.objectstack.system) to register first.
+ * SetupPlugin MUST load before AuthPlugin so that the setupNav service
+ * is registered and available when AuthPlugin.init() tries to contribute menu items.
  */
 const plugins: any[] = [
     new MemoryI18nPlugin(),
     new ObjectQLPlugin(),
     new DriverPlugin(new InMemoryDriver(), 'memory'),
     // Each example stack loaded as an independent AppPlugin
     ...appConfigs.map((config: any) => new AppPlugin(config)),
-    // Auth & Setup plugins (replaces setupAppConfig)
+    // SetupPlugin must come before AuthPlugin (setupNav service dependency)
+    new SetupPlugin(),
+    // AuthPlugin contributes to setupNav during init, so it must come AFTER SetupPlugin
     new AuthPlugin({
       secret: process.env.AUTH_SECRET || 'objectui-server-secret',
       baseUrl: process.env.BASE_URL || 'http://localhost:3000',
     }),
-    new SetupPlugin(),
     new HonoServerPlugin({ port: 3000 }),
     new ConsolePlugin(),
 ];

apps/console/src/mocks/createKernel.ts

@@ -318,16 +318,14 @@ export async function createKernel(options: KernelOptions): Promise<KernelResult
   for (const config of configs) {
     await kernel.use(new AppPlugin(config));
   }
-  // AuthPlugin before SetupPlugin: both use namespace 'sys', and the
-  // ObjectQL registry requires the package that owns objects (AuthPlugin →
-  // com.objectstack.system) to register first.
+  // SetupPlugin MUST load before AuthPlugin so that the setupNav service
+  // is registered and available when AuthPlugin.init() tries to contribute menu items.
+  await kernel.use(new SetupPlugin() as unknown as Plugin);
+  // AuthPlugin contributes to setupNav during init, so it must come AFTER SetupPlugin.
   await kernel.use(new AuthPlugin({
     secret: 'objectui-demo-secret',
     baseUrl: 'http://localhost:5173', // Vite dev server default
   }) as unknown as Plugin);
-  // SetupPlugin registers setupNav during init and the merged Setup app
-  // during start. Must come after AuthPlugin to avoid sys namespace collision.
-  await kernel.use(new SetupPlugin() as unknown as Plugin);
 
   // Register MemoryAnalyticsService so that HttpDispatcher can serve
   // /api/v1/analytics/* endpoints in demo/MSW/dev environments.

objectstack.config.ts

@@ -64,16 +64,14 @@ export default {
     new AppPlugin(prepareConfig(crmConfig)),
     new AppPlugin(prepareConfig(todoConfig)),
     new AppPlugin(prepareConfig(kitchenSinkConfig)),
-    // AuthPlugin before SetupPlugin: both use namespace 'sys', and the
-    // ObjectQL registry requires the package that owns objects (AuthPlugin →
-    // com.objectstack.system) to register first.
+    // SetupPlugin MUST load before AuthPlugin so that the setupNav service
+    // is registered and available when AuthPlugin.init() tries to contribute menu items.
+    new SetupPlugin(),
+    // AuthPlugin contributes to setupNav during init, so it must come AFTER SetupPlugin.
     new AuthPlugin({
       secret: process.env.AUTH_SECRET || 'objectui-dev-secret',
       baseUrl: 'http://localhost:3000',
     }),
-    // SetupPlugin registers setupNav during init and the merged Setup app
-    // during start. Must come after AuthPlugin to avoid sys namespace collision.
-    new SetupPlugin(),
     new HonoServerPlugin({ port: 3000 }),
     new ConsolePlugin(),
   ],