feat(host/web): per-scanner library toggles in the console

Every installed-store scanner (Steam; Lutris+Heroic on Linux; Epic/GOG/
Xbox on Windows) was hardwired on. New library-scanners.json persists the
operator's disabled set (default all on; absent/malformed = all on);
all_games() gates each provider, so disabling one hides its titles from
every surface (console grid, native clients, GameStream app list, launch
resolve). GET /library/scanners lists this platform's scanners + state;
PUT /library/scanners/{id} toggles and emits library.changed — admin lane
only (the cert allowlist's exact-path /library match keeps both off the
LAN surface). The console's Library page grows a "Game sources" card with
one chip per scanner (platform-shaped by the API), EN+DE strings, story.
The scanners are slated to become plugins; the stable per-scanner ids are
the migration seam.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/mgmt/library.rs

@@ -45,6 +45,72 @@ pub(crate) async fn get_library(
     Json(games)
 }
 
+/// Request body for `setLibraryScanner`.
+#[derive(Deserialize, ToSchema)]
+pub(crate) struct ScannerToggle {
+    /// Whether the scanner should run on this host.
+    enabled: bool,
+}
+
+/// List the library scanners
+///
+/// The installed-store scanners this host supports — the list is platform-dependent (Steam
+/// everywhere; Lutris + Heroic on Linux; Epic, GOG, and Xbox/Game Pass on Windows), so the console
+/// renders a toggle only for scanners that can do anything here. Scanners default to enabled;
+/// disabling one hides its titles from every library surface from the next read. The user-curated
+/// custom store is not a scanner and is always on.
+#[utoipa::path(
+    get,
+    path = "/library/scanners",
+    tag = "library",
+    operation_id = "listLibraryScanners",
+    responses(
+        (status = OK, description = "This host's scanners with their enable state", body = [crate::library::ScannerInfo]),
+        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
+    )
+)]
+pub(crate) async fn list_library_scanners() -> Json<Vec<crate::library::ScannerInfo>> {
+    Json(crate::library::list_scanners())
+}
+
+/// Enable or disable a library scanner
+///
+/// Persists the toggle and applies it from the next library read (no restart). Disabling a scanner
+/// hides its titles everywhere — the console grid, native clients, and the GameStream app list —
+/// and re-enabling brings them straight back (nothing is deleted; the scan just runs again). Emits
+/// `library.changed` with the scanner id as `source` when the state changed.
+#[utoipa::path(
+    put,
+    path = "/library/scanners/{id}",
+    tag = "library",
+    operation_id = "setLibraryScanner",
+    params(("id" = String, Path, description = "The scanner id (e.g. `steam`)")),
+    request_body = ScannerToggle,
+    responses(
+        (status = OK, description = "Toggle stored; the full scanner list", body = [crate::library::ScannerInfo]),
+        (status = UNAUTHORIZED, description = "Missing or invalid bearer token", body = ApiError),
+        (status = NOT_FOUND, description = "No such scanner on this platform", body = ApiError),
+        (status = INTERNAL_SERVER_ERROR, description = "Could not persist the settings", body = ApiError),
+    )
+)]
+pub(crate) async fn set_library_scanner(
+    Path(id): Path<String>,
+    ApiJson(toggle): ApiJson<ScannerToggle>,
+) -> Response {
+    match crate::library::set_scanner_enabled(&id, toggle.enabled) {
+        Ok(Some(scanners)) => {
+            tracing::info!(
+                scanner = %id,
+                enabled = toggle.enabled,
+                "management API: library scanner toggled"
+            );
+            Json(scanners).into_response()
+        }
+        Ok(None) => api_error(StatusCode::NOT_FOUND, "no such scanner on this platform"),
+        Err(e) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &e.to_string()),
+    }
+}
+
 /// Add a custom library entry
 ///
 /// Creates a user-curated title (e.g. a non-Steam game, an emulator, a ROM) with caller-supplied

crates/punktfunk-host/src/mgmt/tests.rs

@@ -138,6 +138,13 @@ async fn cert_auth_is_a_read_only_allowlist() {
             "the client roster {p} must require the bearer token, not just a paired cert"
         );
     }
+    // The scanner settings are admin-only in BOTH directions: the exact-path `/api/v1/library`
+    // cert match must not leak the settings GET, and the toggle PUT is operator configuration.
+    assert_eq!(
+        send_cert(&app, get_req("/api/v1/library/scanners"), fp).await,
+        StatusCode::UNAUTHORIZED,
+        "the scanner settings must require the bearer token, not just a paired cert"
+    );
     // The plugin directory is admin-only — a paired streaming cert has no business enumerating the
     // host's running plugins or reaching a plugin UI's proxy credential (plugin-ui-surface §3).
     for p in [
@@ -1309,6 +1316,45 @@ async fn hooks_get_shape_and_put_validation() {
     assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
 }
 
+// ------------------------------------------------------------------ library scanners
+
+/// The scanner list is platform-shaped and read-only-safe; the toggle rejects unknown ids with
+/// 404. (A successful toggle PUT would write the developer's real `library-scanners.json`, so the
+/// write path is exercised only through the unknown-id rejection here — the settings round-trip
+/// itself is unit-tested in `library::scanners` against pure shapes.)
+#[tokio::test]
+async fn library_scanner_list_and_unknown_toggle() {
+    let app = test_app(test_state(), None);
+
+    let (s, json) = send(&app, get_req("/api/v1/library/scanners")).await;
+    assert_eq!(s, StatusCode::OK);
+    let scanners = json.as_array().expect("a scanner array");
+    assert!(
+        scanners
+            .iter()
+            .any(|sc| sc["id"] == "steam" && sc["label"].is_string() && sc["enabled"].is_boolean()),
+        "steam must be a scanner on every platform: {json}"
+    );
+    // Only platform-available scanners appear (`custom` is a store, never a scanner).
+    assert!(scanners.iter().all(|sc| sc["id"] != "custom"));
+
+    let (s, json) = send(
+        &app,
+        axum::http::Request::put("/api/v1/library/scanners/not-a-store")
+            .header(axum::http::header::CONTENT_TYPE, "application/json")
+            .body(Body::from(
+                serde_json::json!({"enabled": false}).to_string(),
+            ))
+            .unwrap(),
+    )
+    .await;
+    assert_eq!(
+        s,
+        StatusCode::NOT_FOUND,
+        "unknown scanner id must 404: {json}"
+    );
+}
+
 // ------------------------------------------------------------------ library providers
 
 /// Provider reconcile validation (the write path itself is unit-tested in `library::custom`