feat(host/library): external provider API — declarative reconcile (M4)

External game-library providers become first-class (RFC §8): a plugin
computes its desired title list and PUTs it — the host owns the diff.

- CustomEntry gains `provider` + `external_id` (API-set only; never on
  manual entries). GameEntry surfaces `provider` for console attribution
  and the new `GET /library?provider=` filter.
- PUT /api/v1/library/provider/{p}: atomic declarative reconcile keyed
  on the provider's `external_id` — host ids stay stable across syncs,
  orphans drop, manual entries and other providers are never touched,
  an empty array clears the set. Validated: provider id [a-z0-9._-]
  (`manual` reserved), unique non-empty external_ids.
- DELETE /api/v1/library/provider/{p}: clean uninstall, returns the
  removed count.
- Ownership is unambiguous both ways: manual CRUD now returns 409 for a
  provider-owned entry (MutateOutcome::ProviderOwned) instead of letting
  an edit be silently clobbered at the next sync.
- library.changed now carries the mutating source (`manual` or the
  provider id) — hooks and the SDK filter on it.
- Spec + SDK schemas regenerated; sdk/examples/provider-sync.ts is the
  provider-plugin skeleton.

347 host tests green (pure reconcile: stable ids, orphan drop,
idempotence, bystanders untouched; name/payload validation; route 400s)
+ 11 SDK tests. Live-verified end to end THROUGH the SDK against a real
host: sync → filtered list → manual-delete 409 → re-sync with stable id
+ orphan drop → uninstall (removed=2), with three
library.changed(source=romm) events observed on the live stream.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/mgmt/tests.rs

@@ -1206,3 +1206,56 @@ async fn hooks_get_shape_and_put_validation() {
     let resp = app.clone().oneshot(req).await.expect("infallible");
     assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
 }
+
+// ------------------------------------------------------------------ library providers
+
+/// Provider reconcile validation (the write path itself is unit-tested in `library::custom`
+/// against pure functions — a successful PUT here would touch the developer's real catalog).
+#[tokio::test]
+async fn provider_reconcile_validation() {
+    let app = test_app(test_state(), None);
+    let put = |provider: &str, body: serde_json::Value| {
+        axum::http::Request::put(format!("/api/v1/library/provider/{provider}"))
+            .header(axum::http::header::CONTENT_TYPE, "application/json")
+            .body(Body::from(body.to_string()))
+            .unwrap()
+    };
+
+    // Reserved / malformed provider ids.
+    let (s, json) = send(&app, put("manual", serde_json::json!([]))).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    assert!(json["error"].as_str().unwrap().contains("reserved"));
+    let (s, _) = send(&app, put("Bad%2FName", serde_json::json!([]))).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+
+    // Payload rules: empty external_id, duplicate external_id.
+    let (s, _) = send(
+        &app,
+        put(
+            "romm",
+            serde_json::json!([{"external_id": "", "title": "X"}]),
+        ),
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    let (s, json) = send(
+        &app,
+        put(
+            "romm",
+            serde_json::json!([
+                {"external_id": "a", "title": "A"},
+                {"external_id": "a", "title": "B"}
+            ]),
+        ),
+    )
+    .await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    assert!(json["error"].as_str().unwrap().contains("duplicate"));
+
+    // DELETE validates the name too.
+    let del = axum::http::Request::delete("/api/v1/library/provider/manual")
+        .body(Body::empty())
+        .unwrap();
+    let (s, _) = send(&app, del).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+}