daemon: D3 (partial) — category.upsert/remove, queue.upsert, download.remove/addBatch/provideAuth

Closes a bounded, high-value slice of the remaining D3 stubs. settings.*/rules.*/
limiter.*/schedule.*/grabber.*/media.*/capture.*/queue.reorder/download.refreshUrl/
download.update stay deferred — reasons noted individually in deferrals.md (settings.*
specifically: a real, large field<->key<->JSON-type mapping table across ~43 fields /
~50 SettingKeys, not started rather than rushed).

category.upsert/remove: store/categories.hpp gains get/upsert/remove. upsert generates
an id when absent and always ignores the payload's `builtin` (preserved from the
existing row on replace, false on create); saveDir goes through the same
fs::resolve_target canonicalize-and-root-check as download.add. remove refuses a
builtin at both layers (dispatcher's -32602 pre-check; the store's own
"DELETE ... AND builtin = 0" as defense in depth) and reassigns member tasks to
reassignTo (default "general") inside one transaction before deleting the row.

queue.upsert: store/queues.hpp gains get/upsert (set_state already existed from D4b).
Same create-generates-id pattern; a create always starts 'stopped', a replace keeps
the queue's current run state (upsert edits config, not run state — that's
queue.start/stop). Also fixed in passing: on_complete has been a real column since
migration 0001 but Queues::list/get never projected it onto Queue.onComplete.

download.remove: cancels with discard_partial=true (always drops the .veloxpart pair —
unlike download.cancel, which keeps them, the row is gone either way), deletes the
finished file only when deleteFile is true and the task was complete (best-effort),
deletes the row (segments cascade via the FK), and publishes event.task.removed
(closing the last open note under D5).

download.addBatch: on_download_add's body is now a shared add_one(), called once per
item after merging each item's unset fields against params.defaults.

download.provideAuth: forwards to EnginePort::provide_auth via a new
TaskActionPort::provide_auth. `remember`/persisting to the Secret Service is accepted
but not acted on — nothing in this build talks to libsecret yet.

Verified against real veloxd + tools/testserver: category create/replace/
remove-with-reassignment, queue create/replace-keeps-run-state, a batch add sharing
defaults.saveDir, and download.remove with deleteFile actually deleting the file and
the task then 404ing download.get with -32010. Full ctest: 39/39.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GRDjHGgpYmMoPE2UFbe7pP

daemon/src/sched/scheduler.cpp

@@ -571,6 +571,15 @@ std::vector<std::string> Scheduler::pause_queue(const std::string& queue_id) {
     return paused;
 }
 
+bool Scheduler::provide_auth(const std::string& wire_id, const std::string& username,
+                             const std::string& password, bool remember) {
+    (void)remember;  // not yet wired to the Secret Service anywhere in this build
+    auto eid = engine_id_of(wire_id);
+    if (!eid) return false;
+    engine_.provide_auth(*eid, username, password, remember);
+    return true;
+}
+
 namespace {
 
 // Extension match against the categories table (categories.extensions, per category.list),

daemon/src/sched/scheduler.hpp

@@ -132,6 +132,9 @@ public:
     // instead of User. Returns the wire ids actually paused.
     std::vector<std::string> pause_queue(const std::string& queue_id) override;
 
+    bool provide_auth(const std::string& wire_id, const std::string& username,
+                      const std::string& password, bool remember) override;
+
     // rpc::TaskActionPort. Builds a vdm::net::ProbeRequest from `params`, runs it on the
     // engine's probe pool (outside the segment budget, ADR 0011 §5), and converts the
     // result back to proto terms — including the suggestedCategoryId/-SaveDir guess (a