Adds a way for users to grow the field library at runtime, from one curated
place, without a rebuild or restart. Content lands in the sources volume where
the ingestion service already auto-indexes it.

Catalog (sources.yaml):
- Becomes the single source of truth: a top-level `collections:` block groups
  the 32 public-domain / CC documents into 8 named bundles (Core Survival,
  Austere Medicine, Food & Water, Power & Engineering, Comms & Radio,
  Education, Civics & Culture, Software), and every item carries a
  `collection:` tag alongside its category. License values containing '#'
  are quoted so they aren't parsed as YAML comments.

CLI (helper-scripts/fetch-source-data.sh):
- Parses the new field; adds `--collection <id>` and `--list-collections`;
  --validate now checks each item references a declared collection.

Server (src/catalog.h new, src/server.cpp):
- GET  /api/catalog  — collections + per-item "installed" state.
- POST /api/import   — { "collection": id }; validates the id against the
  catalog (a closed set) AND as a strict slug, single-flights via an atomic
  flag, and downloads by posix_spawn-ing the bundled fetcher with an explicit
  argv (never a shell). Only the fixed, image-baked manifest URLs are ever
  contacted — no arbitrary-URL / SSRF surface.
- POST /api/upload   — multipart PDF/TXT; filename reduced to a safe basename,
  category constrained to NNN_Name, %PDF magic + size checks, a free-space
  guard, and an atomic link()-based finalise that fails closed (EEXIST → 409)
  so a check-then-rename race can't clobber an existing file.
- Small JSON endpoints (/query, /api/import) reject bodies over
  MAX_REQUEST_BODY; the global body cap is bounded (MAX_UPLOAD_BYTES = 32 MB).

UI (public/): a "+ Add" action on the Field Library panel opens a modal that
lists the collections (with install progress) and a PDF/TXT upload drop zone;
CSP-safe (no inline handlers), design-canon clean.

Air-gapped deployments can disable network import with JIC_DISABLE_NETWORK_IMPORT
(uploading local files stays available).

Verified: end-to-end (catalog lists 8 collections; a real collection downloads
and indexes; an uploaded doc is indexed) and security (path-traversal, command
injection, SSRF, single-flight, disk/DoS) — 17/17; plus degraded test-server.sh
21/21, test-config.sh 38/38, lint-canon, unit tests, clean image build. The
change passed an adversarial security review with a SHIP verdict.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

…ling

Four Copilot review findings on the content-import feature:
- /api/upload: reject a missing "file" form field with a clean 400 (has_file
  check) instead of risking a throw/500 on a malformed multipart body.
- /api/upload: validate the extension case-insensitively (e.g. FOO.PDF), and
  run the %PDF magic-byte check for any-case .pdf — matching ingestion, which
  lowercases extensions.
- /api/upload: fail CLOSED on the free-space guard — if create_directories or
  fs::space errors, reject (500/507) rather than writing without the disk-full
  protection.
- app.js: clear the import progress poll when the modal closes (no more
  background /api/catalog fetches every 3s), and resume it on reopen if an
  import is still running.

Verified: missing-file→400, uppercase .PDF/.TXT accepted, uppercase .pdf
without %PDF magic still →400; clean image build; app.js node --check + lint OK.

Co-Authored-By: Claude Opus 4.8 <[email protected]>