Let a non-blocking checklist item be dismissed with a recorded decision, and run discovery on the mirror once there is something to discover

Plugin/unraid/api/setup.php

@@ -195,6 +195,39 @@ if ($action === 'populate') {
     exit;
 }
 
+// ── POST: defer / undefer a non-blocking checklist item ───────────────────────────────────────
+// Records the operator's "not now" so the checklist can reach complete without the item being
+// green. Only the ids api/checklist.php marks deferrable are accepted — a blocking item cannot be
+// dismissed, because dismissing it would report a mesh as ready when it cannot function.
+if ($action === 'defer' || $action === 'undefer') {
+    // POST only, and not merely by convention: $action is taken from GET too, and Unraid's CSRF
+    // guard checks POST alone. A GET-reachable mutation here would let any page the operator
+    // visits silently dismiss a checklist item.
+    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+        echo json_encode(['ok' => false, 'error' => 'Method not allowed']);
+        exit;
+    }
+    $allowed = ['api_key', 'populated', 'emby_key', 'jellyfin_key'];
+    $item    = trim($_POST['item'] ?? '');
+    if (!in_array($item, $allowed, true)) {
+        echo json_encode(['ok' => false, 'error' => 'Not a deferrable item: ' . $item]);
+        exit;
+    }
+    $state = vv_setup_state_read();
+    $key   = 'DEFER_' . strtoupper($item);
+    if ($action === 'defer') {
+        $state[$key] = (string)time();          // when, not just whether — a stale decision shows its age
+    } else {
+        unset($state[$key]);
+    }
+    if (!vv_setup_state_write($state)) {
+        echo json_encode(['ok' => false, 'error' => 'Failed to write setup state']);
+        exit;
+    }
+    echo json_encode(['ok' => true, 'item' => $item, 'deferred' => $action === 'defer']);
+    exit;
+}
+
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     echo json_encode(['ok' => false, 'error' => 'Method not allowed']);
     exit;