feat(catalogue): a curated file of providers and models, refreshed daily

The five connections in the database were never configured by anyone — a
migration minted one per model from the adapter's own list, so the table held
five decisions nobody made. What that list actually is, is a CATALOGUE: what
you can choose from, which is not the same kind of thing as what you chose.

So it is a file. `sidecar/catalogue/shipped.ts` is the curated baseline, in
git, reviewed; `$OFFICER_ROOT/data/atelier/catalogue.json` is what a refresh
writes, and it wins where it has something to say. Data dir, not the plugin
dir — a plugin directory is a clone an update replaces, which is the rule
env.ts already states for images.

Refresh runs in the sidecar, daily, and only on boot when the file is actually
stale — this process has restarted twenty times in an afternoon and should not
hit OpenAI twenty times for it.

Two sources, unequal, and the code says so. `GET /v1/models` is authoritative
and thin: ids and nothing else, so a model matching /^(gpt-image|dall-e)/
appears the day it ships without a release. Prices come off an HTML page
because there is no pricing endpoint for any plan, and that parser is written
to give up rather than guess — a guess gets written to disk and then believed.
When it gives up it says so in the log; the durable replacement is handing the
page to a model for structured output, which Officer can already do locally.

Nothing a refresh cannot establish overwrites a curated value: fields merge
one by one, not objects wholesale, so an id-only listing cannot wipe the sizes
and prices that were written by hand. Retiring is decided by the merge, which
can tell a complete listing from a request that failed halfway — and it marks
`deprecated` rather than deleting, because the gallery labels 88 historical
rows from this list.

Per-model sizes, qualities and transparency now travel with each entry, which
is what will let the form stop offering dall-e-2 a transparent background it
cannot do. The catalogue is advisory throughout: validate.ts still refuses to
enforce per-model rules, exactly as before.

web/lib/api.ts

@@ -22,14 +22,36 @@ export type ProviderStatus = {
   updated_at: string;
 };
 
-/** The code side — what a new provider can be built on. */
+/** One model in the catalogue — what it makes, what it accepts, what it costs. */
+export type CatalogueModel = {
+  id: string;
+  label?: string;
+  kind: 'image' | 'video';
+  sizes?: string[];
+  qualities?: string[];
+  transparency?: boolean;
+  edit?: boolean;
+  pricing?: Record<string, unknown>;
+  status?: 'current' | 'deprecated';
+  source?: 'shipped' | 'api' | 'scraped';
+};
+
+/**
+ * What a new connection can be built on: a catalogue provider that has an adapter behind it.
+ *
+ * `models` is the flat list of ids; `model_details` carries the per-model facts, which is what lets a
+ * form offer dall-e-2's three sizes rather than gpt-image-1's four. The catalogue is refreshed daily
+ * in the sidecar — `updated_at` says when, and is null while only the shipped file has been read.
+ */
 export type Adapter = {
   name: string;
   label: string;
   models: string[];
+  model_details: CatalogueModel[];
   default_model: string;
   env_var: string;
   supports_edit: boolean;
+  updated_at: string | null;
 };
 
 /** Snake case, matching the server — one spelling per field across every endpoint. */