feat: federation and admin UI pass, sync on selection, sortable listing

[BatLeDev]

UI pass on the registry, centered on federation and the artefact page.

API

• Selecting a remote artefact queues a background sync of that artefact alone (pendingSync, drained under the sync lock so quick successive selections are never lost); progress goes through the existing ws channel.
• The sync mirrors upstream thumbnails (same id), and GET …/remote-artefacts forwards category/format and annotates each row with its local state (synced, up to date, conflict with a local artefact).
• GET …/remote-thumbnails/:id/data proxies upstream thumbnails for the admin table (the browser cannot load them from the upstream: internal URL, Cross-Origin-Resource-Policy: same-origin). Restricted to webp/svg, served with nosniff and a CSP sandbox.
• GET /api/v1/artefacts?sort= accepts a whitelisted key with a leading - for descending; unknown keys are 400, admin-only keys fall back silently for others.

UI

• Home: sortable column headers bound to the sort search param (three-state), table in a card, edit pencil for admins.
• Artefact page: editable metadata form (with the thumbnail staged and saved by the same button, leave-guard included) ahead of the technical sections; tarball and download cards merged into the metadata card.
• Remote registry page: artefacts table aligned on the home list with filters, pagination, per-row sync state fed by the ws channel, proxied thumbnails, conflict rows, error notifications, confirmations before unselecting; url/name and key/new key rows.
• Admin: full-height admin button, Manage button and delete confirmation for remote registries, account avatars and type in the grants picker, localized status chips, plural rules, spacing fixes.
• Form fields default to comfortable density and hide-details: auto app-wide; API key fields are masked text instead of type=password so Chrome stops autofilling them.

Why: the federation flow gave no feedback after selecting an artefact, the remote table lacked search/filters and icons, uploading a thumbnail lost unsaved metadata (koumoul/plateforme#1766), and a series of admin screens needed ergonomic fixes.

Heads-up

• ?sort= with an unknown key now returns 400 instead of the default order.
• Selecting an artefact contacts the upstream right away; an unreachable upstream shows up as lastSyncStatus: error on the registry, not as an error on the POST.
• The Vuetify field defaults apply to every form in the app, VJSF included.
• Unselecting still unlocks the local copy (it becomes a plain local artefact and blocks re-mirroring until deleted) — now explained in a confirmation dialog and flagged in the table.