feat: initial ROM & emulator manager plugin (M0–M5)

A punktfunk-plugin-* package that scans ROM directories, maps them to
emulators, fetches box art, and reconciles them into the host game library
under provider id `rom-manager` — with a console-hosted web UI.

Engine (pure, unit-tested core):
- Table-driven platform registry (~25 consoles) + emulator registry with
  best-effort per-OS detection (PATH / Flatpak / known paths) and RetroArch
  core discovery.
- Scanner with disc folding (m3u/cue/gdi), archive gating, excludes.
- No-Intro title parsing + optional per-platform region dedupe.
- Security-critical quoting seam: POSIX single-quote + Windows double-quote
  with hostile-name refusal; ROM filenames never reach a shell un-quoted.
- Pure desired-state reconcile (stable external_ids, scale guard, fingerprint
  skip) → full-replace PUT /library/provider/rom-manager.

Box art (like Steam ROM Manager): SteamGridDB primary (portrait/hero/logo/
header, fuzzy match, operator API key) behind a provider seam, with keyless
libretro-thumbnails as the zero-setup fallback (`auto` default).

UI: console-hosted via the SDK `servePluginUi` (zero plugin-side auth) with a
plugin-local REST/SSE API and a self-contained React SPA (Setup / Emulators /
Games / Sync). Standalone password-gated fallback for host-only installs.

CLI: scan / detect / preview / sync / uninstall / set-password.

48 engine tests, typecheck + biome clean, SPA builds. Verified end-to-end:
scan → detect → reconcile PUT, fingerprint idempotence, and the standalone
UI serving SPA + REST.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/steamgriddb.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, test } from "bun:test";
+import { SteamGridDbProvider } from "../src/art/steamgriddb.js";
+import { parseTitle } from "../src/engine/titles.js";
+import { platformById } from "../src/platforms.js";
+
+const snes = platformById("snes")!;
+
+/** A fake SteamGridDB backend keyed by URL path fragments. */
+const fakeFetch = (opts: {
+	status?: number;
+	games?: unknown[];
+	grids?: unknown[];
+	heroes?: unknown[];
+	logos?: unknown[];
+}): typeof fetch =>
+	((input: string | URL | Request) => {
+		const url = typeof input === "string" ? input : input.toString();
+		const path = new URL(url).pathname;
+		if (opts.status && opts.status !== 200) {
+			return Promise.resolve(new Response("nope", { status: opts.status }));
+		}
+		let data: unknown[] = [];
+		if (path.includes("/search/autocomplete/")) data = opts.games ?? [];
+		else if (path.includes("/grids/game/")) data = opts.grids ?? [];
+		else if (path.includes("/heroes/game/")) data = opts.heroes ?? [];
+		else if (path.includes("/logos/game/")) data = opts.logos ?? [];
+		return Promise.resolve(Response.json({ success: true, data }));
+	}) as typeof fetch;
+
+describe("SteamGridDbProvider", () => {
+	test("classifies grids into portrait + header and pulls hero + logo", async () => {
+		const provider = new SteamGridDbProvider(
+			"key",
+			fakeFetch({
+				games: [{ id: 1, name: "Chrono Trigger" }],
+				grids: [
+					{ url: "http://p600.png", width: 600, height: 900 },
+					{ url: "http://h460.png", width: 460, height: 215 },
+				],
+				heroes: [{ url: "http://hero.png", width: 1920, height: 620 }],
+				logos: [{ url: "http://logo.png", width: 400, height: 200 }],
+			}),
+		);
+		const art = await provider.resolve(
+			snes,
+			parseTitle("Chrono Trigger (USA)"),
+		);
+		expect(art).toEqual({
+			portrait: "http://p600.png",
+			header: "http://h460.png",
+			hero: "http://hero.png",
+			logo: "http://logo.png",
+		});
+	});
+
+	test("no game match → null", async () => {
+		const provider = new SteamGridDbProvider("key", fakeFetch({ games: [] }));
+		expect(await provider.resolve(snes, parseTitle("Nope"))).toBeNull();
+	});
+
+	test("a bad key (401) disables the provider and returns null", async () => {
+		const provider = new SteamGridDbProvider("bad", fakeFetch({ status: 401 }));
+		expect(await provider.resolve(snes, parseTitle("Anything"))).toBeNull();
+	});
+
+	test("the cache id is scoped to the key (so a key change re-resolves)", () => {
+		const a = new SteamGridDbProvider("k1").id;
+		const b = new SteamGridDbProvider("k2").id;
+		expect(a).not.toBe(b);
+		expect(a.startsWith("steamgriddb:")).toBe(true);
+	});
+});