feat(download): fill model metadata from the source API on download

A ModelScope or Hugging Face download landed as a bare filename, hash and
source link; the model card stayed empty until the user ran "Enrich
Metadata with AI" by hand. But everything that makes a CivitAI download
useful — the display name, the description, the tags, the trigger words,
the example images, the preview — is already published by those sites'
public APIs, so asking for it at download time is deterministic work, not
model work.

Add `py/services/model_sources/hydration.py`, called by
`_save_source_metadata()` once the sidecar exists and the file is in the
scanner cache. It fetches the model card plus the site's card extras and
hands them to the same `PostProcessor` the AI skill uses, with an empty
`llm_output`, so the two paths cannot drift apart. What lands:

* `model_name` from the site's own display name (ModelScope's `Name`), so
  the card stops showing the local filename — written only while the value
  still equals the file stem, since once a user renames a model that
  choice is theirs to keep
* `civitai.name` from the matched version's label (`showName`), which the
  card renders as the version chip
* `civitai.description` / `modelDescription` from the author summary plus
  the README as HTML
* `civitai.images` / `preview_url` from the per-file example images
* `civitai.trainedWords` from the per-file trigger words
* `base_model`, `tags` and `usage_tips` as before

Provenance stays honest: the pass records
`metadata_source = "source:<platform>"` rather than the skill's
`agent:enrich_hf_metadata`, and — because no provider ran — it no longer
stamps `llm_enriched_at`; that stamp is now conditional on the LLM
actually answering, which is what the field means. The five hand-rolled
`civitai` dict merges in the post-processor collapse into one
`_merge_civitai()` helper.

Two guards keep it safe. Only a model whose stored
`source_platform`/`source_url` match the repository being downloaded is
updated, so a local file that merely shares a name never receives another
model's card; and a file already on disk is topped up too, which
back-fills models downloaded before this existed. READMEs and detail
payloads describe the repository rather than the file, so a short-lived
process-wide `ModelSourceCache` (300 s, 32 entries) keeps a batch over one
repository to two HTTP requests. Every failure is logged and swallowed:
hydration can never fail a download.

Fix the hash policy while here. `_save_source_metadata()` went straight to
`MetadataManager.create_default_metadata()`, bypassing the per-type
factory on the owning scanner, so a checkpoint paid a full SHA256 inside
the download request — `CheckpointScanner`/`OtherScanner` deliberately
record `hash_status="pending"` with an empty `sha256` for their multi-GB
files. Metadata is now created through `scanner._create_default_metadata()`.
Hydration copes with the empty hash: `_matching_versions()` falls back to
the repository basename, which is exactly what the download just wrote.

Report both post-transfer stages, which advance no byte counter and so
read as a stall: the bar sat at 100% showing `0 B/s` for the seconds spent
hashing and fetching. `_report_phase()` broadcasts
`{"status": "metadata", "stage": "indexing" | "source", "platform": ...}`,
and `LoadingManager` names the stage in the status line (keeping the batch
position), retitles the item line, replaces the dead speed figure and runs
a sheen over the bar. `stage`/`platform` are machine-readable; the wording
is localised in the frontend.

Finally, `modelscope.ai` is its own catalogue rather than an alias of
`modelscope.cn` — `referall13/EM1` exists only on `.ai` and
`jj3550945163/Krea-2-LORA` only on `.cn` — so its URLs were rejected with
"Invalid model URL format". Register it as `ModelScopeIntlSource`
(`platform="modelscope-ai"`, `msai:` group prefix, its own default
download directory) and derive every URL either deployment builds from a
per-class `base_url`. `modelscope.com` stays an alias of `.cn`, which is
what it redirects to. The frontend source table, the link dialog hints and
the docs mirror the split.

Verified against the live APIs: both reported `.ai` repositories list
their files, read their READMEs and yield name / version / base model /
trigger words / example images. Backend 3092 passed; frontend 1259 JS +
91 Vue passed. The nine locales carry the new progress copy in the next
commit.

tests/frontend/managers/loadingManager.downloadProgress.test.js

@@ -0,0 +1,141 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { I18N_MODULE } = vi.hoisted(() => ({
+  I18N_MODULE: new URL(
+    '../../../static/js/utils/i18nHelpers.js',
+    import.meta.url
+  ).pathname,
+}));
+
+// Interpolate the English fallback the way the real helper does when a locale
+// has not been loaded, so assertions can name the visible text.
+vi.mock(I18N_MODULE, () => ({
+  translate: vi.fn((key, params = {}, fallback) => {
+    if (typeof fallback !== 'string') return key;
+    return Object.entries(params).reduce(
+      (text, [name, value]) => text.replace(`{${name}}`, String(value)),
+      fallback
+    );
+  }),
+}));
+
+const { LoadingManager } = await import(
+  '../../../static/js/managers/LoadingManager.js'
+);
+
+/**
+ * A download's byte counter stops when the last byte lands, but the backend
+ * still hashes the file and reads the model site's API. These tests pin the
+ * rendering that says so, instead of leaving the bar at 100% showing 0 B/s.
+ */
+describe('LoadingManager download progress phases', () => {
+  let manager;
+  let updateProgress;
+
+  beforeEach(() => {
+    document.body.innerHTML = '';
+    LoadingManager.instance = null;
+    manager = new LoadingManager();
+    updateProgress = manager.showDownloadProgress(1);
+  });
+
+  const speedText = () =>
+    document.querySelector('.download-transfer-speed')?.textContent;
+  const itemLabel = () =>
+    document.querySelector('.current-item-label')?.textContent;
+  const itemPercent = () =>
+    document.querySelector('.current-item-percent')?.textContent;
+  const itemBar = () => document.querySelector('.current-item-bar');
+
+  it('shows the byte rate while transferring', () => {
+    updateProgress(42, 0, 'model.safetensors', {
+      bytesDownloaded: 1024,
+      totalBytes: 2048,
+      bytesPerSecond: 512,
+    });
+
+    expect(itemLabel()).toBe('Downloading: model.safetensors');
+    expect(itemPercent()).toBe('42%');
+    expect(speedText()).toMatch(/^Speed: /);
+    expect(itemBar().classList.contains('is-indeterminate')).toBe(false);
+  });
+
+  it('names the indexing stage instead of a stopped speed', () => {
+    updateProgress(100, 0, 'model.safetensors', {}, {
+      phase: 'metadata',
+      stage: 'indexing',
+      platform: 'modelscope',
+    });
+
+    expect(itemLabel()).toBe('Metadata: model.safetensors');
+    expect(itemPercent()).toBe('100%');
+    expect(speedText()).toBe('Reading model file...');
+    expect(manager.statusText.textContent).toBe('Reading model file...');
+    expect(itemBar().classList.contains('is-indeterminate')).toBe(true);
+  });
+
+  it('names the site the metadata is fetched from', () => {
+    updateProgress(100, 0, 'model.safetensors', {}, {
+      phase: 'metadata',
+      stage: 'source',
+      platform: 'modelscope-ai',
+    });
+
+    expect(speedText()).toBe('Fetching metadata from ModelScope (International)...');
+  });
+
+  it('falls back to a generic message for an unknown site', () => {
+    updateProgress(100, 0, 'model.safetensors', {}, {
+      phase: 'metadata',
+      stage: 'source',
+      platform: '',
+    });
+
+    expect(speedText()).toBe('Fetching metadata...');
+  });
+
+  it('returns to the transfer rendering for the next file', () => {
+    updateProgress(100, 0, 'a.safetensors', {}, {
+      phase: 'metadata',
+      stage: 'source',
+      platform: 'modelscope',
+    });
+
+    updateProgress(0, 1, 'b.safetensors');
+
+    expect(itemLabel()).toBe('Downloading: b.safetensors');
+    expect(speedText()).toMatch(/^Speed: /);
+    expect(itemBar().classList.contains('is-indeterminate')).toBe(false);
+  });
+
+  it('keeps the byte counters visible during the metadata stage', () => {
+    updateProgress(100, 0, 'model.safetensors', {
+      bytesDownloaded: 2048,
+      totalBytes: 2048,
+      bytesPerSecond: 0,
+    }, {
+      phase: 'metadata',
+      stage: 'source',
+      platform: 'modelscope',
+    });
+
+    const transferred = document.querySelector('.download-transfer-bytes');
+    expect(transferred.textContent).toContain('/');
+    // The 0 B/s figure is what made the pause look like a stall.
+    expect(speedText()).not.toContain('0 B');
+  });
+
+  it('keeps the batch position visible in the status line', () => {
+    updateProgress = manager.showDownloadProgress(4);
+
+    updateProgress(100, 2, 'c.safetensors', {}, {
+      phase: 'metadata',
+      stage: 'source',
+      platform: 'huggingface',
+    });
+
+    expect(manager.statusText.textContent).toBe(
+      '3/4: Fetching metadata from Hugging Face...'
+    );
+  });
+});