feat(webui): track safe model downloads and cache deletion

[inureyes]

Parent / dependencies

Parent: #1834. Depends on #1835, #1839, #1840.

Ownership

Own the downloader/UI adapter, router_cache.rs integration, bounded download operation progress and cache deletion tests. Existing downloader owns transport, filters, completeness and store containment; no separate shell downloader. Coordinator owner retains lifecycle/event types and shared locks.

Required behavior

• Accept explicit public HuggingFace repo ID and optional revision, not arbitrary URL/local path. Resolve metadata/revision once and pin the download to that immutable commit; carry revision through existing downloader rather than inventing a different cache layout. Display expected destination and known bytes before transfer; unknown size remains unknown. Never execute remote modeling code.
• Use fixed configured store and current offline policy; no requests on catalog browsing. Honor configured offline mode with a typed disabled reason. Private/gated repos return actionable unsupported/auth-required guidance without a token entry form in v1. Do not silently read/browser-persist Hub credentials.
• Reuse download hooks but expose the common operation ID, monotonic received bytes, optional total/rate and real terminal result. Start with one active transfer and a bounded queue per server; no busy polling or network under pool locks. Duplicate repo/revision requests deduplicate; immutable revision mismatch must not overwrite a loaded model.
• Cancel is cooperative and becomes terminal only after writer exit; preserve or clean partial data under an explicit policy. Interrupted/incomplete snapshots never become runnable because config.json happened to arrive first. Publish completion atomically after existing completeness validation; define retry/resume and server-restart reconciliation.
• Cache deletion is a separate confirmed operation, never ordinary unload. Enforce managed-cache source, recheck canonical containment and revision immediately before deletion, refuse busy/loading/downloading models until drained/cancelled, and report actual disk deletion result. Preserve user models-dir/preset files, shared/external artifacts and active download targets.

Acceptance criteria

• Fake HTTP/downloader tests cover valid download, bad repo/revision, gated/404, offline, timeout, disconnect, disk full, checksum/completeness failure, cancel/retry, restart, duplicate action and bounded queue saturation.
• Test symlink swap/traversal/owner-name sanitization and removal races; cancellation cannot publish ready and deletion cannot race a writer or streaming provider.
• One opt-in real public small-checkpoint download completes into the configured store, appears once, loads and generates; record repo+revision. CI hermetic tests do not require external network or GPU.
• Existing compatibility download/removal endpoints call the same primitives and preserve their wire schema; UI-specific 202/progress semantics stay in the versioned adapter.

[inureyes]

The maintainer explicitly approved the managed-cache deletion source-code changes on 2026-09-13 ("관리캐시코드수정도 승인합니다.") after being informed that deletion removes model files and requires downloading them again. This resolves the authorization block for the narrowly scoped implementation edit, not a blanket authorization to delete existing user models.

The approved boundary is an explicit UI confirmation for a managed-cache model, with user-provided model paths excluded. Implement descriptor-bound private quarantine and recursive unlinking without symlink traversal, retaining identity checks, atomic no-replace behavior, operation coordination and case-alias safeguards. Verification must use isolated temporary caches; do not run deletion against existing user checkpoints.

The previous denied attempts to replace descriptor-anchored staging with path-based staging remain disallowed. This approval does not permit weakening that security boundary or bypassing a new safety denial. Complete the independent correctness/security reviews and local acceptance gates before marking the issue done.