Support resumable game folder uploads and remove DLC declarations

docs/native-hosts.md

@@ -17,9 +17,10 @@ the agent owns local execution and its durable operation journal.
 3. The installer validates the platform, installs Python 3 and an absent Docker
    installation, verifies the downloaded agent SHA-256 over HTTPS, enrolls it and
    enables `electric-cherry-agent.service`. It needs no Git, Node.js or local build.
-4. In **Hosts**, prepare a Plutainer runtime image. In **Game Files**, import your
-   existing `t5_game_files` or `t6_game_files` Docker volume on an enrolled source
-   host. Name the library and version and record its DLC metadata.
+4. In **Hosts**, prepare a Plutainer runtime image. In **Game Files**, select T5 or
+   T6 and upload your local game folder. Name the library and version and publish
+   it after the upload finishes. Include the DLC files in that folder; there is
+   no separate DLC declaration. Uploading also works before enrolling any host.
 5. Cache the published version on each destination host. Wait for verification.
    Hosts report connection and readiness separately; deployment also checks the
    particular library, image, capacity and ports you selected.
@@ -73,8 +74,15 @@ API outline:
 - `POST /api/agent/heartbeat`: authenticated inventory, current operation and caches.
 - `GET /api/agent/operations`: deliver/reconcile durable operation IDs.
 - `POST /api/agent/operations/:id`: authenticated acceptance, progress or result.
-- `/api/agent/imports/...` and `/api/agent/libraries/...`: host-scoped uploads and
-  authenticated game-file downloads.
+- `POST /api/game-files`: administrator creates a folder upload with game, name,
+  version, optional description and `files: [{path, size, lastModified}]`.
+- `GET /api/game-files/:id/upload`: durable per-file offsets and publication status.
+- `PUT /api/game-files/:id/upload/files/:path`: administrator uploads a raw chunk
+  with `X-Upload-Offset`, `X-Upload-Length` and `X-Content-SHA256` headers.
+- `POST /api/game-files/:id/upload/complete`: administrator starts asynchronous
+  verification/publication; poll the upload endpoint for completion.
+- `/api/agent/libraries/...`: authenticated game-file downloads. Legacy
+  `/api/agent/imports/...` endpoints remain compatible with already queued imports.
 
 The operation envelope is independent of polling and can be carried over a
 persistent transport later. No unrestricted shell operation is available.
@@ -117,15 +125,37 @@ communication loss stops unrelated running containers.
 
 ## Libraries and ports
 
-Imports scan the source volume and generate per-file SHA-256 manifests. Uploads
-stream to temporary controller storage, are bounded by their manifest sizes and
-verified before atomic publication. Published versions cannot be updated;
+Choose the actual game folder, not its parent, a ZIP archive or the Plutonium
+launcher data folder. The selected folder's name is removed once; nested paths
+such as `zone/english/...` and `main/...` stay intact. Plutonium's
+[T5 server guide](https://plutonium.pw/docs/server/t5/setting-up-a-server/) and
+[T6 server guide](https://plutonium.pw/docs/server/t6/setting-up-a-server/) use a
+copy of the game directory, separately from the launcher/runtime. The uploader
+preserves the supplied files rather than attempting to infer installed maps from
+a manually maintained DLC list.
+
+Folder uploads use chunks of at most 8 MiB, each checked against its SHA-256 before
+being appended to temporary controller storage. Memory usage does not grow with
+the size of an individual game file. Pause/retry uses the controller's saved file
+offsets. After a page reload, choose **Resume upload** and reselect the original,
+unchanged folder; relative paths, sizes and modification times must match. Keep
+the page open while transferring. Once publication starts, the controller hashes
+every complete file and publishes the directory atomically; closing the browser
+does not stop that verification. An interrupted controller can retry publication.
+Published versions cannot be updated;
 changing files requires a new version. Hosts download with HTTP Range resumption,
 report progress, verify all checksums and atomically promote the complete cache.
 Corrupt or incomplete content never becomes Ready. Cache inventory is reconciled
 on heartbeats, including vanished caches. Older immutable versions remain usable
 when their exact manifest is verified.
 
+The controller and reverse proxy must accept 8 MiB upload requests and folder
+manifests up to 32 MiB. Compose sets `BODY_SIZE_LIMIT=Infinity`; application routes
+still enforce these limits, declared file sizes and checksums. Set a proxy body
+limit of at least 32 MiB (for example `client_max_body_size 32m` in nginx).
+Existing published versions and cached host libraries remain usable after the
+upload workflow replaces source-host imports.
+
 Reservations include host ID, local bind address, protocol and port. Wildcard
 binds conflict with concrete addresses on the same host. UDP and TCP reservations
 for one launch commit together; the same number can be used independently on