Resolve toolbox dependencies by source identity and for component imports

[milanofthe]

Problem

Two gaps in the toolbox manager's dependency resolution:

1. Resolution keyed on the toolbox id. The id is a UI-construction artifact — the catalog uses a fixed id, the PyPI tab builds pypi:<pkg>, the file upload inline:<filename>. It reflects how a toolbox was added, not what it is:

• The same PyPI package added via the catalog vs the PyPI tab gets two different ids. A file saved against one is seen as "missing" by a user who has the other, causing a duplicate install, a duplicate registry source, and blocks migrating between Block Library sections.
• Inline toolboxes get inline:<filename> — two different .py files sharing a name collide; opening a file treats the dependency as satisfied and silently uses the locally-installed code instead of the file's embedded code.

2. Direct block/subsystem import resolves nothing. requiredToolboxes only exists on ModelContent. createBlockFile/createSubsystemFile never record it, and importComponent never installs anything — it just throws Unknown block type(s): ... if the toolbox is not installed. A Bubbler4 block exported as .blk and imported on a machine without pathsim-chem hard-fails, even though the same block inside a .pvm model triggers the install flow.

Fix

Source identity (toolbox/identity.ts, new): toolboxSourceKey(source) derives a stable key purely from the install source — pypi:<pkg> (PEP 503 normalized), url:<url>, inline:<code-hash>.

• findMissingRequirements now matches on toolboxSourceKey instead of the raw id, so a file referencing pypi:pathsim-chem resolves against a catalog-installed pathsim-chem, and inline toolboxes match by code rather than filename.
• confirmPyPI/confirmUrl/confirmFile build the id via toolboxSourceKey — inline ids are content-addressed, so same-named uploads no longer collide.
• availableCatalog filters by source identity, so a catalog entry installed via the PyPI tab no longer shows as available.

Component imports:

• BlockContent/SubsystemContent gain an optional requiredToolboxes field.
• createBlockFile/createSubsystemFile record requirements via collectRequiredToolboxes (recurses into subsystem graphs).
• importComponent is now async and installs declared toolboxes (same confirmation dialog as the model path) before validateNodeTypes.