Harden community workflows and preservation tools

[TrapEmAll]

Summary

This hardens the unified Xbox 360 application after the broad Community Hub merge and turns several previously disconnected or preview-only surfaces into dependable workflows.

• wires explicitly enabled, checksum-approved metadata plugins into normal collection without replacing better known title or publisher data
• audits every plugin run and isolates failures and oversized results
• fixes the Community Hub launch bug and moves long operations off the Tk event thread
• makes unified search results navigable to Library, Knowledge, Profiles, and local files
• replaces manual duplicate action IDs with selectable records and validated restore support
• lists captured console snapshots and saved FTP targets instead of requiring database IDs
• adds artwork region/language metadata and Aurora, Freestyle, and archive export choices
• adds unified search and preservation parity to the REST API and CLI
• expands read-only FATX inspection with partition geometry and Xbox 360 USB container detection
• adds bounded read-only STFS file-table inventory and richer original Xbox XBE certificate metadata
• ships the expanded documentation set in Windows and Linux release bundles

Migration notes

Schema migration 9 is additive. It creates plugin_collection_runs and dedup_recovery_records; existing library, knowledge, profile, backup, and download records are preserved. Duplicate actions created before migration remain readable, but only actions applied after migration have tracked one-click restoration records.

Enabled plugins are loaded only from the managed application plugin directory and only while the entrypoint SHA-256 still matches the value approved by the user. A modified plugin must be reviewed and enabled again.

Safety and source considerations

• XboxUnity remains explicitly HTTP-only. No HTTPS endpoint or preference was added.
• Plugin permissions are disclosure metadata, not an OS sandbox; documentation now says this directly.
• FATX, XBE, STFS, profile, and package additions remain read-only.
• Redump and No-Intro data remains user-supplied metadata; no game content is bundled.
• ConsoleMods, XenonLibrary, and Free60 provenance/licensing behavior is unchanged and retained by the knowledge schema.
• Package rebuilding, rehashing, signing, profile ownership mutation, achievement modification, raw FATX writes, and copyrighted payload distribution remain intentionally unavailable until independently verifiable implementations and recovery test vectors exist.

Validation

• 104 passed in the offline pytest suite
• 31 passed in the legacy integration suite
• Ruff, compileall, and version consistency checks pass
• Community Hub constructs all ten tabs in a real Tk smoke test
• PyInstaller Windows one-file build succeeds
• packaged Windows executable remains running in a hidden launch smoke test
• no open repository issues or PRs conflicted with this branch at publication time

Follow-up adapters and platform work

The normalized source architecture remains ready for deeper XenonLibrary and Free60 structured extractors and user-supplied Redump/No-Intro DAT coverage. Future package mutation must stay separate from this read-only foundation. macOS output remains unsigned until project signing/notarization credentials exist; Linux continues to use XDG paths and cross-platform CI.