feat: complete profile intelligence and knowledge controls

[TrapEmAll]

Summary

Completes the remaining practical roadmap items around profiles, saves, knowledge resolution, and console transfers.

• adds bounded, read-only XDBF/GPD inspection with achievement state, gamerscore, timestamps, settings summaries, and extracted-folder discovery
• adds profile comparison for indexed saves and unlocked achievements
• adds snapshot-first Xenia migration previews with atomic verified copies, skip detection, and non-overwriting conflict handling
• adds per-property knowledge-source priorities and durable conflict decisions that influence preferred metadata selection
• adds an opt-in, interval-controlled knowledge refresh on app startup
• adds optional feature-detected remote SHA-256 verification for FTP uploads
• exposes the new workflows in the Profiles & Saves, Knowledge, and Console Sync interfaces
• adds schema migration 7, packaging entries, tests, security notes, architecture notes, and a dedicated profile-intelligence guide

Migration notes

The application upgrades its additive SQLite schema from version 6 to version 7 on startup. The migration adds GPD inventory, achievement, profile comparison, Xenia migration audit, source priority, conflict resolution, scheduler state, and remote-verification fields. Existing library, backup, knowledge, profile, save, and transfer records are preserved.

Xenia migration is deliberately preview-first. A verified profile snapshot is created before any copy begins, existing different files are never overwritten, and every copied file is checked against the previewed SHA-256 digest.

Safety and source considerations

• GPD support is read-only and validates table sizes, entry counts, offsets, and payload bounds before parsing.
• Profile editing, achievement modification, ownership rewriting, STFS rehashing, and CON signing remain intentionally disabled until reliable independent test vectors exist.
• The implementation is informed by Dalavin / DJSkunkieButt's GPLv3 X360 and Le Fluffie work; UnityScraper does not bundle Le Fluffie, updater code, keys, account services, or copyrighted payloads.
• Xenia folder guidance links to the official Xenia Canary documentation; Xenia itself is not bundled.
• FTP remote hash verification is opt-in and only succeeds when the target dashboard exposes a compatible read-only SHA-256 command.
• XboxUnity API behavior remains explicitly HTTP-only. This change does not add, prefer, or advertise HTTPS for XboxUnity endpoints.

Validation

• 93/93 offline unit tests
• 31/31 integration tests
• Ruff checks
• full compile pass
• focused mypy pass for the new and changed service modules
• hidden-window desktop construction smoke test
• Windows PyInstaller build

Deliberate next boundaries

Future work remains hardware-dependent or cryptographically sensitive: broader real-dashboard FTP validation, additional safe GPD title-history/image decoding, and package mutation only after complete extraction, rehashing, signing, verification, and recovery have independent test vectors.