convert settings loaders to modules

public/index.html

@@ -496,7 +496,7 @@
   <script type="module" src="/js/notes.js"></script>
   <script type="module" src="/js/diagrams.js"></script>
   <script type="module" src="/js/clinicalAssistant.js"></script>
-  <script defer src="/js/nextcloud.js"></script>
+  <script type="module" src="/js/nextcloud.js"></script>
   <script type="module" src="/js/wellVisit.js"></script>
   <script defer src="/js/shadess.js"></script>
   <script type="module" src="/js/sickVisit.js"></script>
@@ -504,7 +504,7 @@
   <script defer src="/js/encounters.js"></script>
   <script defer src="/js/memories.js"></script>
   <script defer src="/js/admin-docs.js"></script>
-  <script defer src="/js/documents.js"></script>
+  <script type="module" src="/js/documents.js"></script>
   <script defer src="/js/calc-math.js"></script>
   <script defer src="/js/drugs-loader.js"></script>
   <script type="module" src="/js/calculators.js"></script>

public/js/documents.js

@@ -2,8 +2,6 @@
 // DOCUMENTS.JS — S3 document upload & management UI
 // ============================================================
 
-(function() {
-
   function loadDocuments() {
     var container = document.getElementById('documents-list');
     if (!container) return;
@@ -124,4 +122,3 @@
   });
 
   console.log('Documents module loaded');
-})();

public/js/nextcloud.js

@@ -1,15 +1,24 @@
-(function() {
   var _inited = false;
   document.addEventListener('tabChanged', function(e) {
     if (e.detail.tab !== 'settings' || _inited) return;
     _inited = true;
+  function setNextcloudConnectedStatus(url, user) {
+    var statusEl = document.getElementById('nc-status');
+    if (!statusEl) return;
+    statusEl.textContent = 'Connected to ';
+    var strong = document.createElement('strong');
+    strong.textContent = url || '';
+    statusEl.appendChild(strong);
+    statusEl.appendChild(document.createTextNode(' as ' + (user || '')));
+  }
+
   function loadNextcloudStatus() {
     fetch('/api/auth/me', { headers: getAuthHeaders() })
     .then(function(r) { return r.json(); })
     .then(function(data) {
       var pathSection = document.getElementById('nc-webdav-path-section');
       if (data.user && data.user.nextcloud_url) {
-        document.getElementById('nc-status').innerHTML = '✅ Connected to <strong>' + data.user.nextcloud_url + '</strong> as ' + data.user.nextcloud_user;
+        setNextcloudConnectedStatus(data.user.nextcloud_url, data.user.nextcloud_user);
         document.getElementById('nc-url').value = data.user.nextcloud_url;
         document.getElementById('nc-user').value = data.user.nextcloud_user;
         document.getElementById('btn-nc-disconnect').classList.remove('hidden');
@@ -72,4 +81,3 @@
 
   console.log('✅ Nextcloud module loaded');
   });
-})();

test/clinical-notes-entrypoints.test.js

@@ -137,3 +137,13 @@ test('chart review preserves pasted note coverage cues', () => {
   assert.match(prompts, /avoid copying whole notes/);
   assert.match(prompts, /Pending tests, labs, referrals, medication changes, or action items/);
 });
+
+test('settings scripts expose loaders without rendering account values as HTML', () => {
+  const nextcloud = read('public/js/nextcloud.js');
+  const documents = read('public/js/documents.js');
+  assert.match(nextcloud, /window\.loadNextcloudStatus = loadNextcloudStatus/);
+  assert.match(documents, /window\.loadDocuments = loadDocuments/);
+  assert.match(nextcloud, /function setNextcloudConnectedStatus\(url, user\)/);
+  assert.match(nextcloud, /strong\.textContent = url \|\| ''/);
+  assert.doesNotMatch(nextcloud, /nc-status'\)\.innerHTML/);
+});

test/module-entrypoints.test.js

@@ -12,10 +12,12 @@ const moduleEntrypoints = [
   'public/js/ed-encounters.js',
   'public/js/hospitalCourse.js',
   'public/js/milestones.js',
+  'public/js/nextcloud.js',
   'public/js/notes.js',
   'public/js/sickVisit.js',
   'public/js/soap.js',
-  'public/js/wellVisit.js'
+  'public/js/wellVisit.js',
+  'public/js/documents.js'
 ];
 
 const iifeFreeEntrypoints = [