feat(lora): let a running pod fetch and register a LoRA

[gioelecerati]

Why

A pod builds its LoRA catalog once, in register_library() at engine init. Anything trained after that can never be enabled — enable_lora on an id that wasn't in the boot scan raises "not registered". So a LoRA a user trains while their session is open is unreachable, which is exactly when they want it.

/api/loras re-globs the disk per request, so the catalog would even show a file dropped in later. The engine would still refuse it.

What

New add_lora {id, url} command: fetch a .safetensors into loras_dir() and register it into the live catalog.

• Downloaded on a worker thread. ~170 MB has no business in the dispatch path, let alone the tick. Writes to a .partial and renames on completion, so a dropped connection can't leave a truncated file that the next scan registers and the engine then fails to parse.
• Queued onto state.pending_register, drained in before_tick beside the existing enable/disable queues, so the catalog mutation serializes with the pipeline like every other LoRA change.
• Registration runs before the enables in the same drain, deliberately: a client that adds a LoRA and immediately enables it queues both before the next tick, and the other order raises on every such pair. Registration is metadata-only; weights still materialize inside enable_lora.

Guards

The WS is reachable by anyone holding a session, so:

• the id is sanitized before it becomes a filename and a lora_str_<id> knob name;
• the URL must be https on an allow-listed host (DEMON_LORA_URL_HOSTS). Without that, add_lora is "make this pod GET an arbitrary URL for me" from inside our network — the classic SSRF shape. Defaults cover the orchestrator (Studio-trained LoRAs) and Tigris (user uploads).

Contract

No failure message on the wire, by design: the fetch outlives the request. The catalog is the completion signal — clients watch for the id to appear, then send enable_lora. Wire types regenerated; the capability-gate and dispatcher-parity invariants that tests/unit/test_wire_contract.py enforces were verified against this branch.

Testing

Not yet exercised against a live pod — this needs a :warm rebake to reach the fleet, which is deliberately not part of this PR.

🤖 Generated with Claude Code