feat(download): fill model metadata from the source API on download

A ModelScope or Hugging Face download landed as a bare filename, hash and
source link; the model card stayed empty until the user ran "Enrich
Metadata with AI" by hand. But everything that makes a CivitAI download
useful — the display name, the description, the tags, the trigger words,
the example images, the preview — is already published by those sites'
public APIs, so asking for it at download time is deterministic work, not
model work.

Add `py/services/model_sources/hydration.py`, called by
`_save_source_metadata()` once the sidecar exists and the file is in the
scanner cache. It fetches the model card plus the site's card extras and
hands them to the same `PostProcessor` the AI skill uses, with an empty
`llm_output`, so the two paths cannot drift apart. What lands:

* `model_name` from the site's own display name (ModelScope's `Name`), so
  the card stops showing the local filename — written only while the value
  still equals the file stem, since once a user renames a model that
  choice is theirs to keep
* `civitai.name` from the matched version's label (`showName`), which the
  card renders as the version chip
* `civitai.description` / `modelDescription` from the author summary plus
  the README as HTML
* `civitai.images` / `preview_url` from the per-file example images
* `civitai.trainedWords` from the per-file trigger words
* `base_model`, `tags` and `usage_tips` as before

Provenance stays honest: the pass records
`metadata_source = "source:<platform>"` rather than the skill's
`agent:enrich_hf_metadata`, and — because no provider ran — it no longer
stamps `llm_enriched_at`; that stamp is now conditional on the LLM
actually answering, which is what the field means. The five hand-rolled
`civitai` dict merges in the post-processor collapse into one
`_merge_civitai()` helper.

Two guards keep it safe. Only a model whose stored
`source_platform`/`source_url` match the repository being downloaded is
updated, so a local file that merely shares a name never receives another
model's card; and a file already on disk is topped up too, which
back-fills models downloaded before this existed. READMEs and detail
payloads describe the repository rather than the file, so a short-lived
process-wide `ModelSourceCache` (300 s, 32 entries) keeps a batch over one
repository to two HTTP requests. Every failure is logged and swallowed:
hydration can never fail a download.

Fix the hash policy while here. `_save_source_metadata()` went straight to
`MetadataManager.create_default_metadata()`, bypassing the per-type
factory on the owning scanner, so a checkpoint paid a full SHA256 inside
the download request — `CheckpointScanner`/`OtherScanner` deliberately
record `hash_status="pending"` with an empty `sha256` for their multi-GB
files. Metadata is now created through `scanner._create_default_metadata()`.
Hydration copes with the empty hash: `_matching_versions()` falls back to
the repository basename, which is exactly what the download just wrote.

Report both post-transfer stages, which advance no byte counter and so
read as a stall: the bar sat at 100% showing `0 B/s` for the seconds spent
hashing and fetching. `_report_phase()` broadcasts
`{"status": "metadata", "stage": "indexing" | "source", "platform": ...}`,
and `LoadingManager` names the stage in the status line (keeping the batch
position), retitles the item line, replaces the dead speed figure and runs
a sheen over the bar. `stage`/`platform` are machine-readable; the wording
is localised in the frontend.

Finally, `modelscope.ai` is its own catalogue rather than an alias of
`modelscope.cn` — `referall13/EM1` exists only on `.ai` and
`jj3550945163/Krea-2-LORA` only on `.cn` — so its URLs were rejected with
"Invalid model URL format". Register it as `ModelScopeIntlSource`
(`platform="modelscope-ai"`, `msai:` group prefix, its own default
download directory) and derive every URL either deployment builds from a
per-class `base_url`. `modelscope.com` stays an alias of `.cn`, which is
what it redirects to. The frontend source table, the link dialog hints and
the docs mirror the split.

Verified against the live APIs: both reported `.ai` repositories list
their files, read their READMEs and yield name / version / base model /
trigger words / example images. Backend 3092 passed; frontend 1259 JS +
91 Vue passed. The nine locales carry the new progress copy in the next
commit.

tests/frontend/managers/downloadManager.modelSource.test.js

@@ -266,4 +266,101 @@ describe('DownloadManager external model source downloads', () => {
     expect(manager._externalGroupKey(ms)).toBe('modelscope:u/r');
     expect(manager._externalGroupKey(hf)).not.toBe(manager._externalGroupKey(ms));
   });
+
+  describe('post-transfer stage reporting', () => {
+    it('ignores ordinary frames', () => {
+      const updateProgress = vi.fn();
+
+      expect(
+        manager._applyMetadataStage(
+          { status: 'progress', progress: 40, bytes_per_second: 10 },
+          updateProgress,
+          0,
+          'f.safetensors'
+        )
+      ).toBe(false);
+      expect(updateProgress).not.toHaveBeenCalled();
+    });
+
+    it('routes a metadata stage to the progress bar at 100%', () => {
+      const updateProgress = vi.fn();
+
+      expect(
+        manager._applyMetadataStage(
+          { status: 'metadata', stage: 'source', platform: 'modelscope' },
+          updateProgress,
+          3,
+          'f.safetensors'
+        )
+      ).toBe(true);
+      expect(updateProgress).toHaveBeenCalledWith(100, 3, 'f.safetensors', {}, {
+        phase: 'metadata',
+        stage: 'source',
+        platform: 'modelscope',
+      });
+    });
+
+    it('tolerates a stage frame with no stage or platform', () => {
+      const updateProgress = vi.fn();
+
+      expect(
+        manager._applyMetadataStage({ status: 'metadata' }, updateProgress, 0, 'f')
+      ).toBe(true);
+      expect(updateProgress).toHaveBeenCalledWith(100, 0, 'f', {}, {
+        phase: 'metadata',
+        stage: '',
+        platform: '',
+      });
+    });
+
+    it('surfaces a metadata frame received while the request is in flight', async () => {
+      // End-to-end through the websocket handler: the backend keeps the socket
+      // open while it hydrates, and the frame has to reach the progress bar.
+      const sockets = [];
+      class RecordingWebSocket {
+        constructor(url) {
+          this.url = url;
+          this.onopen = null;
+          this.onmessage = null;
+          this.onerror = null;
+          this.close = vi.fn();
+          sockets.push(this);
+          queueMicrotask(() => this.onopen && this.onopen());
+        }
+      }
+      vi.stubGlobal('WebSocket', RecordingWebSocket);
+
+      const updateProgress = vi.fn();
+      mockLoadingManager.showDownloadProgress.mockReturnValue(updateProgress);
+
+      mockApiClient.downloadModelSource.mockImplementation(async () => {
+        sockets.at(-1).onmessage({
+          data: JSON.stringify({
+            status: 'metadata',
+            stage: 'source',
+            platform: 'modelscope',
+          }),
+        });
+        return { success: true };
+      });
+
+      manager.sourcePlatform = 'modelscope';
+      manager.sourceRepoId = 'u/r';
+      manager.sourceSelectedFiles = ['a.safetensors'];
+
+      await manager._downloadExternalRepoFiles({
+        modelRoot: '/models',
+        targetFolder: '',
+        useDefaultPaths: false,
+      });
+
+      expect(updateProgress).toHaveBeenCalledWith(100, 0, 'a.safetensors', {}, {
+        phase: 'metadata',
+        stage: 'source',
+        platform: 'modelscope',
+      });
+
+      mockLoadingManager.showDownloadProgress.mockReturnValue(vi.fn());
+    });
+  });
 });