fix(recipes): reject the empty-hash placeholder when resolving LoRA hashes

The SHA256 of an empty byte string (written by repackaging tools into
safetensors metadata, or produced by hashing an empty/unreadable file)
was previously resolved against CivitAI's by-hash API, which can contain
polluted entries for it (e.g. a broken SD 1.5 LoRA whose AutoV3 equals
the placeholder) and falsely attributed the wrong model to a recipe.

Guard all lookup paths for the 10/12/64-char AutoV2/AutoV3/full-SHA256
spellings: CivitaiClient.get_model_by_hash/_fetch_version_by_hash return
not-found without a request, and ModelHashIndex ignores the placeholder
in has_hash/get_path/add_autov3.

The Automatic1111 metadata parser keeps the LoRA item itself when its
hash is the placeholder: it matches by filename locally, or retains the
entry with an empty hash flagged hashInvalid (unresolvable-hash state in
the UI, with reconnect as the remedy) instead of dropping it or resolving
it to a polluted CivitAI entry.

py/recipes/parsers/automatic.py

@@ -8,6 +8,7 @@ from typing import Dict, Any
 from ..base import RecipeMetadataParser
 from ..constants import GEN_PARAM_KEYS
 from ...services.metadata_service import get_default_metadata_provider
+from ...utils.constants import is_empty_placeholder_hash
 
 logger = logging.getLogger(__name__)
 
@@ -524,6 +525,26 @@ class AutomaticMetadataParser(RecipeMetadataParser):
                 weight = prompt_entries[0][1] if len(prompt_entries) == 1 else 1.0
                 lora_entry = make_lora_entry(lora_type, lora_name, weight, lora_hash)
 
+                if is_empty_placeholder_hash(lora_hash):
+                    # The empty-hash placeholder (SHA256 of an empty byte
+                    # string) is not a real hash: never look it up in the
+                    # local hash index or on CivitAI. Match by filename;
+                    # otherwise keep the item as unresolved (no hash, flagged
+                    # hashInvalid so the UI shows the unresolvable-hash state
+                    # and offers reconnect instead of download) rather than
+                    # dropping it.
+                    if recipe_scanner and lora_type == 'lora' and basename_key not in queried_local_basenames:
+                        local_lora = await recipe_scanner.get_local_lora(lora_name, recipe_base_model)
+                        if local_lora:
+                            local_entry = self.populate_lora_from_local(lora_entry, local_lora)
+                            merge_or_append_local(local_entry)
+                            continue
+                    lora_entry['hash'] = ''
+                    lora_entry['hashInvalid'] = True
+                    if not resource_lora_count:
+                        loras.append(lora_entry)
+                    continue
+
                 if lora_hash and recipe_scanner and lora_type == 'lora':
                     local_lora = await recipe_scanner.get_local_lora_by_hash(lora_hash)
                     if local_lora: