feat: add verified local Comic Vine catalog downloads and matching

[DeusExTaco]

Summary

• Add an opt-in catalog download card in Settings → Metadata with transfer progress, resumable downloads, daily updates, and manual retry.
• Verify signed publications, artifact hashes, SQLite identity/content, and cumulative patches before atomically activating a generation. Retain the previous working catalog after failed updates.
• Use the local catalog for Add Series, import matching, manual overrides, orphan recovery, and basic issue hydration. Preserve Comic Vine IDs and existing live metadata.

Boundaries

• Store the catalog on the Pullbox server, separately from the library database.
• Keep full metadata refresh and post-import enrichment on the existing direct Comic Vine provider path.
• Do not silently fall back to online discovery after a local miss.
• Add no metadata proxy endpoints, ComicRack compatibility, MEGA distribution, or production deployment.

Validation

• make ci-full passed: lint, typing, migration/boot, coverage gate, accessibility, Chromium/Firefox, security gates, and Docker smoke tests.
• Final full application regression run after the data-precedence correction: 11,148 passed, 13 skipped, 1 expected failure.
• Commit hooks and working-tree/commit secret scans passed.
• Downloaded and verified published catalog 20260913T182755Z in an isolated instance; exercised no-key local search, manual update checks, and persisted update preferences.
• Validated the same artifact in the Linux container with networking disabled: 160,488 series, 1,135,145 issues, working FTS search and zstd decoding.
• Checked the Metadata controls in both themes with no WCAG violations.

Implementation and recovery details: docs/development/LOCAL_CATALOG_V2.md.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T22:36:36.933387Z	1dd9027	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1dd9027238

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[DeusExTaco]

I verified the current branch with make ci-full before pushing a3c502b.

• Main suite: 11,156 passed; coverage 91.02%.
• Accessibility: 25 passed.
• Chromium and Firefox: 558 passed and 2 skipped each.
• Production Docker build, runtime security, blocking vulnerability gate, and all 7 smoke tests passed.
• Workflow hygiene, secret scans, lint, formatting, typing, and migration/boot checks passed. Existing security exceptions are unchanged.
• Commit hooks and the post-commit working-tree/history secret scan also passed.

This update restores ComicVine access as the first settings card and fixes both review findings: missing catalog IDs no longer fail unrelated profiles in the same batch, and an installed catalog is recovered independently of missing or invalid status state. Regression tests cover both fixes.

The ci:full label is applied. Required GitHub checks must be green before merging; I have not merged this PR.