[ccomb]

Stacked on #780, which reads the padded method files the IMPACT World+ collections come in. Retarget to main once #780 is merged.

Problem

To score with a method collection the engine does not ship, a user has to find the publisher's file, download it, then upload it. Nothing tells them which collections are known to load, and nothing checks that the file they found is the one expected.

Solution

The engine carries a catalogue, data/method-catalog.toml, of collections it can fetch itself: Environmental Footprint 3.1, and the expert, midpoint and footprint versions of IMPACT World+ 2.2.1. Each entry states the publisher, version, licence (when the publisher states one), the page to cite, the file's https address, its size and its SHA-256.

• GET /api/v1/method-collections/available lists the catalogue, each entry saying whether the engine already knows a collection of that name.
• POST /api/v1/method-collections/available/{name}/install downloads the file, keeps it only when its size and SHA-256 match, stores it as an upload of that name and loads it.

The download follows no redirect, stops one byte past the stated size, gives up after a minute without data, and sends a User-Agent: one of the file servers refuses requests without one.

Answers: 403 on a read-only engine, 404 for a name not in the catalogue, 409 for a name already known, 413 when the file is above the plan's upload limit, 502 when the server cannot be reached or answers with an error status, 422 when the file received is not the one expected.

Wire revision 103. pyvolca gains available_method_collections() and install_method_collection(name).

Remarks

• The catalogue is part of the reference data, so data/VERSION moves.
• The new dependency is http-client-tls, listed in THIRD_PARTY_LICENSES.md. No method file is shipped with the engine, so none is listed there.
• No MCP tool: uploads are not offered over MCP either.

How to test

./build.sh --test
# on a running engine with a writable data directory:
curl -s localhost:8080/api/v1/method-collections/available
curl -s -X POST "localhost:8080/api/v1/method-collections/available/IMPACT%20World%2B%202.2.1%20Footprint/install"
curl -s localhost:8080/api/v1/method-collections   # the collection is listed, loaded, with 6 categories

Done on a local engine: the four collections installed and loaded (Environmental Footprint 3.1 with 25 categories; IMPACT World+ Expert, Midpoint and Footprint with 36, 21 and 6). A second install answered 409; an unknown name, 404. From the REPL, fetchEntry refused a file of the wrong size, a file with a different SHA-256, a server answering 410 and an address it cannot parse, each with its reason.