feat(prune): add recovery-backed removed game cleanup

[danielcopper]

Summary

• Add explicit bulk and inline cleanup for local ROM entries that RomM definitively no longer has.
• Repoint wedged shortcuts to the natural live version while preserving their appId, or remove fully vanished games only through a separate default-off confirmation.
• Seal a checksum-verified recovery bundle before destructive work and integrate exact save ownership, .romm-backup quarantine, installed-content selection, and Steam-only state recovery.
• Add bounded, tokenized frontend/backend action and continuation lifetimes so cleanup cannot overlap launch-option, artwork, collection, playtime, migration, download, core/disc, uninstall, or stale-shortcut writes.
• Document the user flow, recovery contents, failure behavior, architecture, and cross-cutting invariants.

Safety Contract

• Only a fresh exact-id RommNotFoundError authorizes deletion. Live, malformed, wrong-id, timeout, transport, auth, 5xx, cancellation, and unknown outcomes retain data.
• Each preview/run is pinned to one RomM server, token, and user namespace; a response from another namespace cannot authorize deletion.
• Bulk candidates require a completed platform fetch generation. Inline cleanup is scoped to an already-vanished row but performs the same fresh proof.
• Recovery defaults on. Installed ROM content is selected per ROM and defaults off; insufficient selected recovery space blocks confirmation.
• Exclusive current saves move through the existing .romm-backup quarantine funnel. Shared, unknown, unsafe, recreated, and save-state files remain untouched.
• Fully vanished Steam removal captures shortcut fields, collections, playtime, artwork, Steam Input, and the relevant controller value before mutation. Attempted but unconfirmed removal remains an explicit ambiguous partial.
• Filesystem mutation is descriptor-relative, no-follow, mount-aware, hash-bound, writer-excluded, and atomic no-replace where backup history is published.
• Completion reports exact, partial, and ambiguous mutations truthfully and uses bounded frames with stale/foreign/duplicate protection.

The resolved behavior and decisions are also recorded in #1570:
#1570 (comment)

Verification

mise run gate passed on the final commit:

• 6,597 backend tests
• 2,367 frontend tests across 99 files
• Ruff check and format
• basedpyright: 0 errors, 0 warnings, 0 notes
• ESLint, Prettier, TypeScript typecheck
• 8 import-linter contracts
• callable manifest: 134 callables
• event parity: 17 events
• all repository invariant, hash, Markdown, and link checks
• Rollup build
• size-limit: 592.27 kB / 830 kB

Backend/domain, recovery/destructive-safety, and frontend/Steam/wire reviews have no outstanding findings.

Manual Validation Required

No runtime data was changed during development or automated validation. Before merge, perform the backup-backed Game Mode pass documented in the implementation checklist, including:

• offline/uncertain proof retains everything;
• live-sibling repoint keeps appId and launches the confirmed target;
• fully vanished removal occurs only with the default-off option enabled;
• the sealed bundle validates with sha256sum -c checksums.sha256;
• exclusive saves enter .romm-backup, shared saves remain, and save states remain untouched;
• unrelated Steam artwork, Input, controller state, saves, ROMs, settings, BIOS, and shortcuts remain unchanged.

Part of #1570.

[sonarqubecloud]

Quality Gate passed

Issues
80 New issues
0 Accepted issues

Measures
0 Security Hotspots
85.3% Coverage on New Code
0.3% Duplication on New Code

See analysis details on SonarQube Cloud