feat(library): import curated collections + upload your own documents

[FzzySwtr]

Stacked on #19 (self-healing model loading). Base is that branch so this PR shows only the import diff — merge #19 first, then this retargets to main cleanly.

Why

There was no user-facing way to grow the field library — content could only be added via CLI/compose. This adds a way to import libraries from one curated place (public-domain, categorized) and to upload your own documents, both in-app and via CLI. New files land in the sources volume where ingestion already auto-indexes them — no rebuild, no restart.

What

Catalog — sources.yaml is now the single source of truth

• A top-level collections: block groups the 32 public-domain/CC docs into 8 named bundles (Core Survival, Austere Medicine, Food & Water, Power & Engineering, Comms & Radio, Education, Civics & Culture, Software); every item carries a collection: tag alongside its category.
• License values containing # are quoted (so they're not parsed as YAML comments).

CLI — fetch-source-data.sh

• --collection <id>, --list-collections; --validate now checks each item references a declared collection.

Server — src/catalog.h (new) + src/server.cpp

• GET /api/catalog — collections + per-item installed state.
• POST /api/import { "collection": id } — validates the id against the catalog (closed set) and as a strict slug; single-flights via an atomic flag; downloads by posix_spawn-ing the bundled fetcher with an explicit argv (never a shell). Only the fixed, image-baked manifest URLs are ever contacted → no arbitrary-URL / SSRF surface.
• POST /api/upload — multipart PDF/TXT; filename reduced to a safe basename, category constrained to NNN_Name, %PDF magic + size checks, a free-space guard, and an atomic link() finalise that fails closed (EEXIST → 409) so a check-then-rename race can't clobber a file.
• /query and /api/import reject bodies over MAX_REQUEST_BODY; global body cap bounded (MAX_UPLOAD_BYTES = 32 MB).

UI — public/

• A "+ Add" action on the Field Library panel opens a modal: collections with install progress + a PDF/TXT upload drop zone. CSP-safe (no inline handlers), design-canon clean.

Air-gapped: JIC_DISABLE_NETWORK_IMPORT disables network import; uploading local files stays available.

Verification

• End-to-end (17/17): catalog lists 8 collections; a real collection (comms-and-radio) downloads and indexes; an uploaded .txt gets indexed; installed-state flips.
• Security (17/17 exercised + adversarial review → SHIP): ../../../pwned.txt sanitized to stay inside its category; injection-y import id → 404 (no shell); traversal category → 400; fake-PDF → 400; single-flight import → 409; disk/DoS guarded.
• Degraded test-server.sh 21/21 · test-config.sh 38/38 · lint-canon · unit tests · clean image build.

Reviewer notes

• Import shells out via posix_spawn with a validated, closed-set collection id and an explicit argv — no /bin/sh, no client-supplied URL. Works under the read_only/cap_drop: ALL hardening (curl + the fetcher + sources.yaml are image-baked; writes go to the writable sources volume).
• The 32 MB global body cap is an accepted, documented tradeoff on this single-user offline appliance (cpp-httplib's payload limit is process-global). Non-blocking follow-up: move the upload to a streaming multipart ContentReader to drop even the transient buffer.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a user-facing “grow the library” workflow to JustInCase by introducing a curated content catalog (importable by collection) plus a direct PDF/TXT upload path that writes into the existing sources volume for ingestion to auto-index.

Changes:

• Add server endpoints for catalog listing, collection import (via posix_spawn), and multipart document upload with validation/guards.
• Define curated “collections” in sources.yaml and extend the fetch helper to filter/list by collection and validate collection membership.
• Add a UI modal (+ CSS/JS wiring) to install curated collections and upload local documents.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/server.cpp	Adds /api/catalog, /api/import, /api/upload, and payload-size gating; implements import worker spawning and upload validation/storage logic.
src/config.h	Introduces MAX_UPLOAD_BYTES and config/env helpers for catalog path, fetcher path, and network-import enablement.
src/catalog.h	New minimal manifest parser for collections + items used by /api/catalog and /api/import validation.
sources.yaml	Adds top-level collections: and tags each source item with a collection:.
public/index.html	Adds “+ Add” action and modal markup for curated import + upload UI.
public/app.js	Implements modal open/close, catalog rendering, import triggering + polling, and upload flow/drag-drop.
public/style.css	Styles the new “add content” modal and catalog/upload UI elements.
helper-scripts/fetch-source-data.sh	Adds --collection, --list-collections, and validation that each item references a declared collection.