feat: initial ROM & emulator manager plugin (M0–M5)

A punktfunk-plugin-* package that scans ROM directories, maps them to
emulators, fetches box art, and reconciles them into the host game library
under provider id `rom-manager` — with a console-hosted web UI.

Engine (pure, unit-tested core):
- Table-driven platform registry (~25 consoles) + emulator registry with
  best-effort per-OS detection (PATH / Flatpak / known paths) and RetroArch
  core discovery.
- Scanner with disc folding (m3u/cue/gdi), archive gating, excludes.
- No-Intro title parsing + optional per-platform region dedupe.
- Security-critical quoting seam: POSIX single-quote + Windows double-quote
  with hostile-name refusal; ROM filenames never reach a shell un-quoted.
- Pure desired-state reconcile (stable external_ids, scale guard, fingerprint
  skip) → full-replace PUT /library/provider/rom-manager.

Box art (like Steam ROM Manager): SteamGridDB primary (portrait/hero/logo/
header, fuzzy match, operator API key) behind a provider seam, with keyless
libretro-thumbnails as the zero-setup fallback (`auto` default).

UI: console-hosted via the SDK `servePluginUi` (zero plugin-side auth) with a
plugin-local REST/SSE API and a self-contained React SPA (Setup / Emulators /
Games / Sync). Standalone password-gated fallback for host-only installs.

CLI: scan / detect / preview / sync / uninstall / set-password.

48 engine tests, typecheck + biome clean, SPA builds. Verified end-to-end:
scan → detect → reconcile PUT, fingerprint idempotence, and the standalone
UI serving SPA + REST.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/quote.test.ts

@@ -0,0 +1,119 @@
+import { describe, expect, test } from "bun:test";
+import { quotePosix, quoteWindows, renderCommand } from "../src/quote.js";
+
+describe("quotePosix", () => {
+	test("wraps a plain path in single quotes", () => {
+		const r = quotePosix("/roms/snes/Chrono Trigger (USA).sfc");
+		expect(r).toEqual({
+			ok: true,
+			value: "'/roms/snes/Chrono Trigger (USA).sfc'",
+		});
+	});
+
+	test("escapes embedded single quotes", () => {
+		const r = quotePosix("it's a rom.sfc");
+		expect(r.ok && r.value).toBe("'it'\\''s a rom.sfc'");
+	});
+
+	test("neutralises shell metacharacters (no expansion possible)", () => {
+		for (const evil of [
+			"$(rm -rf ~).sfc",
+			"`id`.sfc",
+			"; rm x.sfc",
+			"a && b.sfc",
+			"$HOME.sfc",
+		]) {
+			const r = quotePosix(evil);
+			expect(r.ok).toBe(true);
+			// Everything stays inside a single-quoted literal.
+			if (r.ok)
+				expect(r.value.startsWith("'") && r.value.endsWith("'")).toBe(true);
+		}
+	});
+
+	test("rejects a NUL byte", () => {
+		expect(quotePosix("a\0b").ok).toBe(false);
+	});
+});
+
+describe("quoteWindows", () => {
+	test("double-quotes a normal path", () => {
+		const r = quoteWindows("C:\\Games\\Chrono Trigger (USA).sfc");
+		expect(r).toEqual({
+			ok: true,
+			value: '"C:\\Games\\Chrono Trigger (USA).sfc"',
+		});
+	});
+
+	test("refuses each cmd.exe metacharacter", () => {
+		for (const bad of [
+			'a"b',
+			"a%b",
+			"a!b",
+			"a^b",
+			"a&b",
+			"a|b",
+			"a<b",
+			"a>b",
+		]) {
+			expect(quoteWindows(bad).ok).toBe(false);
+		}
+	});
+
+	test("refuses control characters", () => {
+		expect(quoteWindows("a\nb").ok).toBe(false);
+		expect(quoteWindows("a\tb").ok).toBe(false);
+	});
+
+	test("doubles a trailing backslash run so the closing quote is not escaped", () => {
+		const r = quoteWindows("C:\\dir\\");
+		expect(r.ok && r.value).toBe('"C:\\dir\\\\"');
+	});
+});
+
+describe("renderCommand", () => {
+	test("POSIX: quotes rom + core, inserts exe verbatim", () => {
+		const r = renderCommand(
+			"{exe} -f -L {core} {rom}",
+			{
+				exe: "flatpak run org.libretro.RetroArch",
+				rom: "/roms/Chrono Trigger (USA).sfc",
+				core: "/cores/snes9x_libretro.so",
+			},
+			"linux",
+		);
+		expect(r).toEqual({
+			ok: true,
+			command:
+				"flatpak run org.libretro.RetroArch -f -L '/cores/snes9x_libretro.so' '/roms/Chrono Trigger (USA).sfc'",
+		});
+	});
+
+	test("Windows: a hostile ROM name fails the whole render", () => {
+		const r = renderCommand(
+			"{exe} {rom}",
+			{ exe: '"C:\\ra.exe"', rom: "C:\\roms\\a&b.sfc" },
+			"windows",
+		);
+		expect(r.ok).toBe(false);
+	});
+
+	test("appends trusted extra args verbatim", () => {
+		const r = renderCommand(
+			"{exe} {rom}",
+			{ exe: "mgba", rom: "/x.gba" },
+			"linux",
+			"--scale 4",
+		);
+		expect(r.ok && r.command).toBe("mgba '/x.gba' --scale 4");
+	});
+
+	test("errors on an unfilled placeholder", () => {
+		const r = renderCommand(
+			"{exe} -L {core} {rom}",
+			{ exe: "ra", rom: "/x.sfc" },
+			"linux",
+		);
+		expect(r.ok).toBe(false);
+	});
+});