feat(links): support ModelScope and TensorArt as model sources

A model file could only ever be linked to huggingface.co: `set_hf_url`
validated the URL with a huggingface-only regex, the agent fetched the card
from a hardcoded HF URL, and the readme processor built every relative image
path off `https://huggingface.co/{repo}/resolve/main`. ModelScope publishes the
same model-card convention (README.md + YAML frontmatter, often carrying
`base_model:` and `trigger_words:`) behind a public, key-less API, so the
enrichment pipeline could already serve it - it was the plumbing that was
HF-shaped, not the idea.

Make the external source a first-class, provider-driven concept:

- New `py/services/model_sources/` registry. A `ModelSource` owns URL
  recognition (lenient for stored values, strict for user input), the
  canonical page URL, model-card fetching, the asset base URL and the
  capability flags. `HuggingFaceSource` is the previous logic relocated;
  `ModelScopeSource` reads `/models/{o}/{n}/resolve/{master|main}/README.md`
  and falls back to `/api/v1/models/{o}/{n}/repo`. `TensorArtSource` is
  link-only on purpose: tensor.art answers plain HTTP clients with a
  Cloudflare challenge and its internal API (ap-east-1.tensorart.cloud /
  cn.tensorart.net) rejects every /v1/model/* route with "invalid
  authorization header", so it declares supports_enrichment=False rather than
  failing silently later.
- Metadata gains `source_platform` + `source_url`; `hf_url` stays as a
  read/write alias, written only for Hugging Face, so existing sidecars,
  cached rows and third-party consumers keep working. Normalisation runs at
  the scanner, the persistent cache (both directions, plus two new columns
  behind an ALTER migration) and the linking handler - which is what stops a
  user who switches sources from leaving a stale `hf_url` on a ModelScope
  model.
- The agent pipeline keys off the provider instead of `hf_url`: the fast-fail
  gate now explains *why* a model is skipped (no source / unknown source /
  source without a reachable card), the prompt context exposes
  source_url/source_id/source_label/asset_base_url while still filling the
  legacy hf_url/repo aliases, and the four README image extractors take a
  base_url (defaulting to HF) so relative paths resolve against the right
  site. Version grouping generalises to hf: / ms: / ta: keys.
- `POST /api/lm/set-hf-url` keeps its path and its legacy payload keys but
  accepts `source_url`, validates against every provider and returns the
  platform. `GET /api/lm/model-sources` lets the UI render the supported-site
  list from the server.
- Frontend: a `modelSourceHelpers` mirror of the registry drives the link
  dialog, the card/modal globe (branded "View on ModelScope/TensorArt"), the
  version-group key and the enrichment gate; the versions tab no longer sends
  ms:/ta: keys to the CivitAI API.

TensorArt stays in the list because provenance is worth keeping even when the
card is unreadable - the dialog says so plainly ("Sites that don't expose one
(currently TensorArt) can only be linked") and the context menu disables
enrichment with a matching tooltip, instead of the user getting
"Unsupported URL".

Verified against the real ModelScope API: jj3550945163/Krea-2-LORA returns a
1882-byte card whose frontmatter carries base_model/tags/trigger_words, and
relative images resolve to .../resolve/master/....

Tests: backend 2815 passed; frontend 1130 JS + 91 Vue passed; pytest
tests/i18n and a Jinja compile pass over templates/. The nine locales carry
[TODO: Translate] for the new strings, completed in the next commit.

py/services/model_sources/huggingface.py

@@ -0,0 +1,49 @@
+"""Hugging Face model source."""
+
+from __future__ import annotations
+
+import re
+
+from .base import ModelSource, fetch_text
+
+#: Lenient — used to normalise URLs already stored in metadata; tolerates
+#: sub-paths such as ``/resolve/main/model.safetensors``.
+_URL_PATTERN = re.compile(
+    r"https?://(?:www\.)?huggingface\.co/(?P<id>[^/?#\s]+/[^/?#\s]+)"
+)
+
+#: Strict — validates what the user pasted into the "link model" dialog.
+_STRICT_URL_PATTERN = re.compile(
+    r"https?://(?:www\.)?huggingface\.co/(?P<id>[^/?#\s]+/[^/?#\s]+)/?$"
+)
+
+
+class HuggingFaceSource(ModelSource):
+    """Hugging Face Hub (``huggingface.co``)."""
+
+    platform = "huggingface"
+    label = "Hugging Face"
+    supports_enrichment = True
+    supports_download = True
+    url_pattern = _URL_PATTERN
+    strict_url_pattern = _STRICT_URL_PATTERN
+
+    def canonical_url(self, source_id: str) -> str:
+        return f"https://huggingface.co/{source_id}"
+
+    def asset_base_url(self, source_id: str, revision: str = "") -> str:
+        return f"https://huggingface.co/{source_id}/resolve/{revision or 'main'}"
+
+    async def fetch_model_card(self, source_id: str) -> str:
+        """Fetch ``README.md`` from Hugging Face (tries ``main``, then ``master``)."""
+
+        for branch in ("main", "master"):
+            text = await fetch_text(
+                f"https://huggingface.co/{source_id}/raw/{branch}/README.md"
+            )
+            if text:
+                return text
+        return ""
+
+
+__all__ = ["HuggingFaceSource"]