feat: add profile and save manager

[TrapEmAll]

Summary

Adds a dedicated Profiles & Saves workspace for safely inventorying and backing up Xbox 360 profile and save data.

• scans standard Xbox 360 Content layouts without modifying source media
• identifies profile packages and saved-game STFS packages
• reads Title ID and ownership identifiers from documented STFS header fields
• resolves game names from the local library and XboxUnity title catalog
• creates hash-verified full-profile or selected-save snapshots
• verifies snapshots before restore and preserves destination conflicts
• masks profile, console, and device identifiers in the GUI by default
• records scan, snapshot, restore, and conflict history in SQLite
• adds packaging support, documentation, security guidance, and tests

Database migration

Schema version advances from 5 to 6. The additive migration creates:

• profile_scan_runs
• xbox_profiles
• profile_saves
• save_snapshots
• save_snapshot_files
• profile_save_operations

Existing library, knowledge, backup, and XboxUnity catalog data is retained.

Safety and privacy

• source scans are read-only
• profile/save data is not uploaded
• identifiers are masked in the UI unless explicitly revealed
• snapshots use partial files, SHA-256 verification, and atomic publication
• restore requires a user-selected destination
• differing existing files are never overwritten; restored conflicts receive a new filename
• no account editing, resigning, rehashing, key vaults, console keys, or embedded signing keys are included
• XboxUnity remains HTTP-only as required by the project

Le Fluffie / X360 provenance

The STFS field mapping and profile/save model were informed by Dalavin, also known as DJ SkunkieButt / DJ Shepherd, and the archived GPLv3 X360/Le Fluffie source at https://github.com/mtolly/X360.

The repository includes the upstream GPLv3 license text and a clear third-party notice. It does not bundle the legacy executable, updater, artwork, account-modification code, or embedded key resources.

Validation

• 87 unit tests passed
• 31 integration tests passed
• Ruff passed
• focused mypy checks passed
• Python compilation passed
• hidden Tk workspace construction passed
• Windows PyInstaller executable built successfully
• packaged attribution file verified
• packaged key-material scan clean

Next steps

This establishes the safe inventory and snapshot layer. Future work can add GPD inspection, achievement metadata, Xenia interoperability, profile comparison, and explicitly user-supplied resign/rehash workflows after their cryptographic and legal boundaries are designed and reviewed.