feat: initial ROM & emulator manager plugin (M0–M5)

A punktfunk-plugin-* package that scans ROM directories, maps them to
emulators, fetches box art, and reconciles them into the host game library
under provider id `rom-manager` — with a console-hosted web UI.

Engine (pure, unit-tested core):
- Table-driven platform registry (~25 consoles) + emulator registry with
  best-effort per-OS detection (PATH / Flatpak / known paths) and RetroArch
  core discovery.
- Scanner with disc folding (m3u/cue/gdi), archive gating, excludes.
- No-Intro title parsing + optional per-platform region dedupe.
- Security-critical quoting seam: POSIX single-quote + Windows double-quote
  with hostile-name refusal; ROM filenames never reach a shell un-quoted.
- Pure desired-state reconcile (stable external_ids, scale guard, fingerprint
  skip) → full-replace PUT /library/provider/rom-manager.

Box art (like Steam ROM Manager): SteamGridDB primary (portrait/hero/logo/
header, fuzzy match, operator API key) behind a provider seam, with keyless
libretro-thumbnails as the zero-setup fallback (`auto` default).

UI: console-hosted via the SDK `servePluginUi` (zero plugin-side auth) with a
plugin-local REST/SSE API and a self-contained React SPA (Setup / Emulators /
Games / Sync). Standalone password-gated fallback for host-only installs.

CLI: scan / detect / preview / sync / uninstall / set-password.

48 engine tests, typecheck + biome clean, SPA builds. Verified end-to-end:
scan → detect → reconcile PUT, fingerprint idempotence, and the standalone
UI serving SPA + REST.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/titles.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, test } from "bun:test";
+import {
+	dedupeKey,
+	parseTitle,
+	pickBestRelease,
+} from "../src/engine/titles.js";
+
+describe("parseTitle", () => {
+	test("strips No-Intro tags and keeps region + revision metadata", () => {
+		const p = parseTitle("Chrono Trigger (USA) (Rev 1) [!]");
+		expect(p.displayTitle).toBe("Chrono Trigger");
+		expect(p.noIntroName).toBe("Chrono Trigger (USA) (Rev 1) [!]");
+		expect(p.region).toBe("USA");
+		expect(p.revision).toBe("Rev 1");
+	});
+
+	test("normalises a trailing article", () => {
+		expect(parseTitle("Legend of Zelda, The (USA)").displayTitle).toBe(
+			"The Legend of Zelda",
+		);
+	});
+
+	test("recognises multi-region tags", () => {
+		const p = parseTitle("Sonic (USA, Europe)");
+		expect(p.regions).toEqual(["USA", "Europe"]);
+		expect(p.region).toBe("USA");
+	});
+
+	test("converts underscores and collapses whitespace", () => {
+		expect(parseTitle("Super_Mario__World").displayTitle).toBe(
+			"Super Mario World",
+		);
+	});
+
+	test("a tagless name is its own title", () => {
+		const p = parseTitle("Tetris");
+		expect(p.displayTitle).toBe("Tetris");
+		expect(p.region).toBeUndefined();
+	});
+});
+
+describe("region dedupe", () => {
+	test("groups by base title", () => {
+		expect(dedupeKey(parseTitle("Sonic (USA)"))).toBe(
+			dedupeKey(parseTitle("Sonic (Europe)")),
+		);
+	});
+
+	test("pickBestRelease honors region priority, then shortest name", () => {
+		const items = [
+			{ parsed: parseTitle("Sonic (Europe)") },
+			{ parsed: parseTitle("Sonic (USA)") },
+			{ parsed: parseTitle("Sonic (Japan)") },
+		];
+		const best = pickBestRelease(items, ["USA", "World", "Europe", "Japan"]);
+		expect(best.parsed.region).toBe("USA");
+	});
+
+	test("falls back to shortest name when no region matches priority", () => {
+		const items = [
+			{ parsed: parseTitle("Game (Korea) (Beta)") },
+			{ parsed: parseTitle("Game (Korea)") },
+		];
+		const best = pickBestRelease(items, ["USA"]);
+		expect(best.parsed.noIntroName).toBe("Game (Korea)");
+	});
+});