SettingsController::updatePersonal() throws NotAdminException for non-admin users (missing #[NoAdminRequired])

Nextcloud Whiteboard version: 1.5.9
Nextcloud server version: 34.0.3

Bug description

The personal setting for auto-uploading a recording on disconnect (autoUploadOnDisconnect, surfaced in the UI under Personal Settings → Whiteboard, with the save error shown as "Failed to save recording preference.") cannot be saved by any user who is not a member of the Nextcloud admin group.

Root cause

lib/Controller/SettingsController.php's updatePersonal() method has no #[NoAdminRequired] attribute (and no attribute at all). Nextcloud's AppFramework SecurityMiddleware requires admin-group membership by default unless a controller method is explicitly marked #[NoAdminRequired]. Since updatePersonal() is meant to be a per-user personal preference endpoint (unlike update(), which is the actual admin-only server config form for serverUrl/secret/maxFileSize and is correctly admin-gated by the same default), it should carry this attribute but doesn't.

Steps to reproduce

1. Log in as a Nextcloud user who is not in the admin group.
2. Go to Personal Settings → Whiteboard.
3. Toggle "auto-upload recording on disconnect" and save.
4. Observe a 403 in the browser network tab and "Failed to save recording preference." in the UI.

Server-side evidence (nextcloud.log)

OC\AppFramework\Middleware\Security\Exceptions\NotAdminException
"Logged in account must be an admin" — Code 403
thrown by SecurityMiddleware::beforeController() before SettingsController::updatePersonal() runs

Suggested fix

Add the #[NoAdminRequired] attribute to updatePersonal() only (leave update() untouched, since that one is correctly admin-only):

use OCP\AppFramework\Http\Attribute\NoAdminRequired;

#[NoAdminRequired]
public function updatePersonal(): DataResponse {
    ...
}

Minor secondary issue

The frontend error string ("Failed to save recording preference.") doesn't match what the setting actually controls (auto-upload-on-disconnect for recordings, not a recording on/off preference) — worth a wording pass while this is being looked at, though it's cosmetic compared to the access-control bug above.

Open lib/Controller/SettingsController.php and inspect updatePersonal() alongside update(). Add the shown NoAdminRequired attribute only to updatePersonal(), leaving update() admin-only. Verify that a non-admin user can save autoUploadOnDisconnect from Personal Settings and that the reported 403 no longer occurs.