feat: give local model metadata a shared service owner

[atomantic]

Summary

MTPLX needed repository ages but imported huggingFaceCatalog.js, pulling in GGUF/MLX selection, Ollama registry enrichment and music rendering. Move the existing Hub reads and shared request/cache state into server/services/huggingFaceMetadata.js; both consumers now use that owner. MTPLX's static import closure drops from 57 modules to 36.

Audit evidence and scope

• Audited local-model Hub discovery after a repository-wide size inventory, 150-commit churn scan and importer search. Kept one finding: metadata consumers depended on catalog internals. Before this change, server/services/mtplxModelManager.js:31 imported dates from the catalog; server/services/huggingFaceCatalog.js:11 imported music rendering, while lines 711–871 owned transport/cache and line 1347 exposed generic age enrichment.
• New owner: server/services/huggingFaceMetadata.js:120 (raw search), :162 (cached repo reads), :210 (bounded dates). Authentication, retry, concurrency, single-flight and memory-cache state move together. Model ranking, variants, measured fit and installability remain in the catalog. Persistence remains in huggingFaceRepoCache.js.
• Reuse search covered server/lib/README.md, its barrel, docs/ARCHITECTURE.md, Hub/repo metadata/cache terms, and importers of huggingfaceModel.js, huggingfaceLora.js, huggingFaceRepoCache.js and ollamaRegistryCatalog.js. The image/LoRA adapters have different projection, error and cache contracts; the existing disk cache is reused unchanged. No second fetch implementation or broad services catalog was added. The architecture map documents placement for future consumers.
• Prior-work searches covered open task data, closed issues and merged PRs by module, symbol and behavior. show a Hugging Face model's age in days on the download lists #4831 introduced the age consumer; HuggingFace catalog caches gated/private-repo auth denials for 7 days even after credentials are fixed #4365/fix(issue-4365): retry Hugging Face auth-denied catalog repos #4422 established retry-after-auth-denial behavior, retained here. No overlapping metadata-owner work was found. Excluded active queue admission work ([complexity-media-queue-slot-accounting] Collapse repeated lane admission accounting in drainLoop #6677/refactor: unify media queue lane admission accounting #6678), recently split Video/Tailcat owners, declarative model lists, intentional runtime adapters and a file-size-only catalog split.
• Compatibility: preserve the old catalog fetchRepoPublishedDates export, return values, cache paths/formats, auth-denial handling, budgets and lazy request behavior. No migration or provider calls at import time. Moved function bodies are identical apart from export declarations.

Test plan

• Passed 208 tests across huggingFaceCatalog, huggingFaceRepoCache, mtplxModelManager, routes/localLlm and lib/importScoping using the server Vitest command.
• Extended the existing workflow test to prove simultaneous catalog and direct metadata consumers make one Hub request; the compatibility export reads the same cached dates.
• Import guards prevent MTPLX from reaching catalog selection and metadata from reaching music rendering, with positive controls for the new owner and disk cache.
• Existing coverage retains offline/timeout, auth-denial retry, transient-versus-durable caching, bounded response bodies, variants, MTPLX search results and route contracts. git diff --check passed.