feat: deliver unified Xbox 360 collection platform

[TrapEmAll]

Summary

This brings the 0.11, 0.12, 0.13, and initial 1.0 roadmap foundations together as UnityScraper 1.0.0 beta 1.

• adds versioned additive SQLite migrations for collections, preservation, repair plans, console snapshots, transfer jobs, metadata overrides, and recovery state
• adds XEX2 TitleID/MediaID/version/disc parsing, mounted-storage discovery, and immutable read-only Aurora database import
• adds exact MediaID Title Update compatibility, collection health scoring, multi-disc checks, repair-plan previews, batch verification/export, and Aurora-oriented export
• adds Redump/No-Intro local hash matching, inferred release/region/language/revision facts, offline HTML reports, manifests, and provenance exports
• adds persistent resumable FTP upload/download jobs, pause/resume, bandwidth limits, transfer verification, read-only console snapshots, and PC/console comparison
• adds database backup/restore assistance, atomic queue recovery, plugin API v1, UI scaling and keyboard navigation, Italian/Portuguese translation foundations, and verified platform update staging
• adds CycloneDX SBOM generation, GitHub build-provenance attestations, expanded packaged documentation, and 1.0 beta version synchronization

XboxUnity remains explicitly HTTP-only. No HTTPS preference or invented XboxUnity transport was introduced.

Migration notes

Migrations are additive and tracked in app_schema_migrations with SQLite user_version = 4. Existing library, knowledge, download, and backup tables are retained. The Help workspace and CLI provide consistent SQLite backup/restore operations. Metadata overrides are separate records and never overwrite imported source claims.

Creating a repair plan is preview-only. Aurora database import and console inventory snapshots are read-only. FTP passwords remain memory-only and are not persisted.

Source and licensing considerations

• ConsoleMods, XenonLibrary, and Free60 content continues through the existing source-attributed adapter/cache model.
• Redump and No-Intro support consumes user-supplied DAT metadata only; no game content is fetched or distributed.
• Every knowledge fact retains source/citation/confidence data, and local overrides remain separate.
• Plugin API permissions are disclosure metadata rather than an OS sandbox; plugins are disabled until explicitly enabled.
• Standard FTP is unencrypted and documented for trusted local networks only.

Validation

• Ruff: pass
• Core tests: 67 passed
• Integration tests: 31 passed
• Targeted mypy for new foundation modules: pass
• Python compileall: pass
• Version synchronization: pass (1.0.0b1)
• CycloneDX SBOM generation: pass
• Windows PyInstaller smoke build: pass (26.5 MB executable)

Beta follow-up

• validate FTP resume behavior across Aurora, FSD, and other dashboard FTP implementations
• exercise migrations and health scoring against larger real-world libraries
• test Linux release packaging in GitHub Actions and broaden distribution coverage
• add field-specific source-priority controls and scheduled knowledge refreshes