Rework library sync around a JSON document; add card filters

Sync

The previous design put the merge inside SQL: timestamp-stamping triggers,
a tombstone table, per-device SQLite snapshots, a device id in the database,
and row merges written as correlated-subquery UPDATEs. All of that schema
was inherited by desktop, and the merge was very hard to verify.

Replace it with a single JSON document plus a three-way merge in plain Rust.
Storing the last-read remote document as the merge base makes "who changed
what" and "what was deleted" derivable, which removes the tombstone table,
the updated_at columns and all eight triggers. It also makes a single shared
file safe: if a publish is lost the remote is unchanged, so the next merge
re-detects the local edits and republishes rather than reading their absence
as a deletion. That removes the need for per-device files and for device
identity entirely. Schema impact drops to one column, decks.uuid.

Conflicts resolve to "theirs", which is required for convergence rather than
chosen for taste — preferring ours has each device re-asserting its own value
forever. Every such choice is reported to the user.

SQLite becomes invisible: the working copy lives in the app data dir and the
user only ever names a .json file. There is always a document, defaulting to
private storage, so edits are never stranded with nowhere to be saved.
Pointing at a file that doesn't exist yet moves the current library there;
pointing at one that does adopts it. A converter brings a pre-document
library.db across.

Android reaches the folder through the Storage Access Framework rather than
MANAGE_EXTERNAL_STORAGE, so no storage permission is declared at all.

Filters

Track card origin in reference.db: Universes Beyond, digital-only and
Un-set cards, plus numeric power/toughness. Each origin flag is derived as
"every printing", not "any printing" — ordinary cards get reprinted into
those sets, and Lightning Bolt appearing in Marvel Commander must not hide
it. Non-numeric power ("*", "1+*") stays NULL so it drops out of range
filters instead of being compared as zero.

Also wire up filters over data already present: price range, format legality
(restricted counts as legal) and "can be a commander". All of these degrade
silently against an older reference.db rather than failing every query.

The shared criteria live in one component used by both filter panels, as a
compact row of icon toggles.

Card Search gains the Library tab's bulk selection: checkboxes in both views,
select-all, and a bulk add-to-deck with a single undo for the whole batch.

src/api.ts

@@ -94,6 +94,28 @@ export interface LibraryFilter {
   in_deck?: number | null;
   location?: string | null;
   oracle_text?: string | null;
+  /** Hide cards that exist *only* as Universes Beyond (Lord of the Rings,
+   *  Warhammer 40,000, Marvel, …). Ordinary cards reprinted into a UB set are
+   *  kept. Needs card data downloaded after this shipped; inert otherwise. */
+  exclude_universes_beyond?: boolean;
+  /** Hide Arena/MTGO-only cards (Alchemy rebalances) — they can't be owned on
+   *  paper. Needs card data downloaded after this shipped; inert otherwise. */
+  exclude_digital_only?: boolean;
+  /** Hide Un-set cards (Unglued, Unhinged, Unstable, Unfinity). */
+  exclude_funny?: boolean;
+  /** Cheapest known printing in USD; cards with no known price count as 0. */
+  price_min?: number | null;
+  price_max?: number | null;
+  /** Format slug ("commander", "modern", …). Legal and restricted match. */
+  legal_in?: string | null;
+  /** Only cards that can head a Commander deck. */
+  can_be_commander?: boolean;
+  /** Printed power/toughness. Cards printed with "*" or "1+*" are excluded,
+   *  since those can't be compared numerically. */
+  power_min?: number | null;
+  power_max?: number | null;
+  toughness_min?: number | null;
+  toughness_max?: number | null;
 }
 
 export interface Status {
@@ -108,6 +130,40 @@ export interface Status {
   is_mobile: boolean;
 }
 
+/** State of the user's library document — the JSON file they keep in whatever
+ *  folder they sync. The SQLite database behind it is internal and never shown. */
+export interface SyncStatus {
+  /** Whether a document has been chosen. */
+  chosen: boolean;
+  /** Whether it's currently reachable. Distinct from `chosen`: an Android grant
+   *  can be revoked and a desktop folder can be deleted or unmounted — both need
+   *  re-picking rather than first-time setup. */
+  granted: boolean;
+  label: string | null;
+  /** True where the folder is chosen through the system picker (Android) rather
+   *  than by path — the one thing the UI branches on. */
+  picker_based: boolean;
+  /** A pre-document library.db from an older build, waiting to be converted. */
+  legacy_library: string | null;
+}
+
+/** What one sync did. */
+export interface SyncReport {
+  /** Whether the merge altered the local library. */
+  changed: boolean;
+  /** Whether the document was rewritten (skipped when we had nothing to add). */
+  published: boolean;
+  /** Conflict copies absorbed and cleaned up. */
+  absorbed: number;
+  report: {
+    cards_changed: number;
+    decks_changed: number;
+    decks_removed: number;
+    /** Fields both sides changed differently, described in user terms. */
+    conflicts: string[];
+  };
+}
+
 export interface LibraryStats {
   unique_cards: number;
   total_copies: number;
@@ -181,11 +237,22 @@ export function legalStatusFor(legalities: number, formatLabel: string): LegalSt
 
 export const api = {
   getStatus: () => invoke<Status>("get_status"),
-  setLibraryPath: (path: string) => invoke<Status>("set_library_path", { path }),
   updateCardData: () => invoke<Status>("update_card_data"),
   cancelUpdateCardData: () => invoke<void>("cancel_update_card_data"),
   /** Adopt an already-built reference.db from `path` instead of downloading it. */
   importReferenceDb: (path: string) => invoke<Status>("import_reference_db", { path }),
+  syncStatus: () => invoke<SyncStatus>("sync_status"),
+  /** Merge the library document with local edits and publish the result.
+   *  Resolves with `null` when a sync was already running and this call stood
+   *  down — expected, since sync also fires automatically. */
+  syncNow: () => invoke<SyncReport | null>("sync_now"),
+  /** Android: grant access to a folder through the system picker. */
+  syncPickFolder: () => invoke<SyncStatus>("sync_pick_folder"),
+  /** Desktop: adopt a library document chosen with the file dialog. */
+  syncSetDocument: (path: string) => invoke<SyncStatus>("sync_set_document", { path }),
+  syncForgetDocument: () => invoke<SyncStatus>("sync_forget_document"),
+  /** Convert a pre-document library.db into the current format. */
+  convertLegacyLibrary: (path: string) => invoke<SyncReport>("convert_legacy_library", { path }),
 
   searchCards: (query: string, limit = 20) =>
     invoke<CardRef[]>("search_cards", { query, limit }),