sa3 LoRA Manager

[JakeHartnell]

Brings custom Stable Audio 3 finetunes into LSDJ end-to-end (ADR-0028, built on
the #44 spike): import them, manage them, and play them — up to four at once,
each with its own strength — from every generate surface. Along the way, our
LoRA runtime contribution merged upstream, so this PR also retires the fork.

Importing & managing adapters

• LoRA Library section in the settings drawer: import by HuggingFace repo id
  or pasted URL (huggingface.co/… and hf.co/… forms normalize to the
  canonical id), or a local .safetensors via the native file picker.
• ADR-0028's trust boundary, enforced in the Rust shell: .safetensors only —
  pickle (.ckpt/.pt/.pth/.bin) is refused before any read, and only the
  safetensors JSON header is ever parsed. Both conventions are read (SA3-native
  metadata and PEFT adapter_config.json).
• The adapter's base DiT is inferred from its tensor shapes (small vs medium
  fan-in widths are disjoint, measured from the runtime); rank-only -xs
  adapters fall back to the PEFT config or an explicit base choice.
• Registry = the filesystem: sa3-loras/<base>/<slug>/ in the app data dir,
  watched live (hand-dropped folders appear, deletes propagate), surviving
  restarts with nothing else to persist. Install/cancel/progress and delete
  match the Add an in-app model manager: download Magenta + Stable Audio models from a settings overlay #43 model manager, on the same single-install pipeline.

Playing them — the LoRA rack

Every base-matched adapter renders as a toggle chip in a one-line rack strip
(Generate tab, Samples tab, and both deck columns — deck-accented on the decks).
Clicking a chip into the stack grows a trim knob beside it: ×0–×2 in quarter
steps, double-click parks ×1, and ×0 is the bit-exact bypass, shown as a
dimmed slot. Up to four adapters stack per generation; slots stay in library
order because the merge is order-independent. Trims are remembered per adapter
while toggling; a deleted adapter silently drops from the next request.

/api/generate gains loras: [{name, strength}, …] — validated at the trust
boundary (installed-adapter resolution, base-vs-kind match, strength 0–4 bounds,
cap 4, duplicate refusal) and emitted as one --lora <dir> strength=<s> group
per adapter.

Back on upstream

Our MLX merge-at-load runtime landed as Stability-AI/stable-audio-3#57, and #65
extended it with the per-adapter strength= syntax this PR emits — so
sa3-pin.json reverts from the fork to upstream, per ADR-0028's stated exit.
The model manager offers the switch as a normal SA3 update.

Testing

• Backend: registry trust boundaries, exact argv (verified against upstream's
  parse_lora_spec grammar), and the full /api/generate contract incl.
  boundary/NaN/duplicate/cap rejections.
• Rust: importer validation, base inference, HF filename constraints, URL
  normalization (needs cargo clippy/cargo test on CI or a Mac — the sandbox
  can't build the shell).
• Frontend: 593 tests across the rack, library, and all three call sites.
• Human pass: docs/issue-66-checklist.md — Maqam import, audible effect,
  seed-fixed ×0 hash equality, lifecycle, wrong-base 422, and the new
  multi-adapter section (run the in-app SA3 update first).