feat: initial ROM & emulator manager plugin (M0–M5)

A punktfunk-plugin-* package that scans ROM directories, maps them to
emulators, fetches box art, and reconciles them into the host game library
under provider id `rom-manager` — with a console-hosted web UI.

Engine (pure, unit-tested core):
- Table-driven platform registry (~25 consoles) + emulator registry with
  best-effort per-OS detection (PATH / Flatpak / known paths) and RetroArch
  core discovery.
- Scanner with disc folding (m3u/cue/gdi), archive gating, excludes.
- No-Intro title parsing + optional per-platform region dedupe.
- Security-critical quoting seam: POSIX single-quote + Windows double-quote
  with hostile-name refusal; ROM filenames never reach a shell un-quoted.
- Pure desired-state reconcile (stable external_ids, scale guard, fingerprint
  skip) → full-replace PUT /library/provider/rom-manager.

Box art (like Steam ROM Manager): SteamGridDB primary (portrait/hero/logo/
header, fuzzy match, operator API key) behind a provider seam, with keyless
libretro-thumbnails as the zero-setup fallback (`auto` default).

UI: console-hosted via the SDK `servePluginUi` (zero plugin-side auth) with a
plugin-local REST/SSE API and a self-contained React SPA (Setup / Emulators /
Games / Sync). Standalone password-gated fallback for host-only installs.

CLI: scan / detect / preview / sync / uninstall / set-password.

48 engine tests, typecheck + biome clean, SPA builds. Verified end-to-end:
scan → detect → reconcile PUT, fingerprint idempotence, and the standalone
UI serving SPA + REST.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/wire.ts

@@ -0,0 +1,33 @@
+// The host provider-reconcile wire shapes (mirrors `@punktfunk/host`'s generated `ProviderEntryInput`
+// et al. — the facade doesn't re-export them, and we PUT the raw array via `pf.request`, so we own the
+// shape here). Kept minimal and stable; the host validates it.
+
+/** Cover art — all URLs. The console/clients prefer `portrait` for a grid (design §7). */
+export interface Artwork {
+	portrait?: string | null;
+	hero?: string | null;
+	logo?: string | null;
+	header?: string | null;
+}
+
+/** How the host launches a title. For this plugin always `{ kind: "command", value: <shell command> }`. */
+export interface LaunchSpec {
+	kind: "command";
+	value: string;
+}
+
+/** A per-title prep/undo step (design §6): `do` runs before launch, `undo` at session end (reverse order). */
+export interface PrepCmd {
+	do: string;
+	undo?: string | null;
+}
+
+/** One title in the declarative reconcile payload (`PUT /api/v1/library/provider/rom-manager`). */
+export interface ProviderEntryInput {
+	/** The provider's stable id for this title — the reconcile diff key (design §4: `<platform>/<relpath>`). */
+	external_id: string;
+	title: string;
+	art?: Artwork;
+	launch?: LaunchSpec | null;
+	prep?: PrepCmd[];
+}