Multi-source Phase C2: onboarding wizard — populate-vs-empty + deep-history choice (#98)

[jozef2svrcek]

Phase C2 of multi-source (#40). Redesigns the setup wizard's source step per the locked design: onboarding stays a simple binary, with all per-source detail deferred to Maintenance → Sources (C1, #97).

What changed (SetupWizard.tsx, client-only)

Replaces the inline "download + import TWIC with a progress bar" step with a Sources step:

• Binary choice — Populate the reference database (recommended) vs Start with an empty database.
• Populate path:
  • Currency: TWIC + Lichess Broadcasts auto-selected (the auto-updating feeds).
  • Deep history: Free (the bulk archive — currently Ajedrez OTB) · I own a commercial DB (reuses the existing AddGameDialog local PGN import path — no new backend) · None.
  • One acknowledgment list with a per-source credit checkbox (non-commercial licences flagged), reusing the C1 credit_acked gate (sources_set_enabled with credit_acked).
  • Enabling fires sources_sync jobs that run on the daemon in the background, so onboarding finishes immediately instead of blocking on a progress bar.
• Express/Welcome/Done copy updated off TWIC; twic step + its TWIC-only helpers/imports removed.

Notes

• No new backend: the commercial route and background sync both reuse existing job types.
• Caissabase-as-default "Free" history still depends on its hosted PGN (Server-side source-manifest service (Lumbra's, Bundesliga) — decouple fragile URL discovery from app releases #94); until then Free = Ajedrez OTB.
• The auto-import-on-enable wiring and a global activity view are Phase C3 (Multi-source Phase C3: background-activity dashboard + enable→auto-sync #99); here the wizard explicitly submits the sync jobs.

Verification

• npm run build (tsc + vite) passes clean on Node 22.

Relates to #40. Closes #98.

🤖 Generated with Claude Code

[jozef2svrcek]

Code-review follow-ups (deferred from the #1–#5 fixes in 161b5d6)

High-effort review surfaced these lower-severity findings on SourcesStep. Tracked here rather than fixed in this PR:

• Bump vite and @vitejs/plugin-react in /chess-client #6 — Completion fires before games land (enableAndImport). The step completes the instant sync jobs are submitted, so in Express the following dedup/index steps run over an empty/partial DB. Largely inherent to Multi-source Phase C2: onboarding wizard — populate-vs-empty + deep-history choice #98's "finish immediately" model; post-import maintenance belongs to the background activity work in Multi-source Phase C3: background-activity dashboard + enable→auto-sync #99 (C3).
• Bump postcss from 8.5.8 to 8.5.15 in /chess-client #7 — No idempotency / redundant re-syncs. Re-running the step re-enables and re-submits sources_sync for every selected source unconditionally, including already-current ones — queues duplicate daemon work. Skip sources that are already enabled + synced.
• Bump rand from 0.8.5 to 0.8.6 in /chess-db #8 — Overloads server kind as onboarding policy. The wizard treats feed=force-on currency and bulk=free deep-history, but the server documents kind as "only a UI label for cadence." A future source whose cadence doesn't match its onboarding role gets silently force-enabled/mis-bucketed. Add an explicit per-source onboarding-role flag to the catalog instead.
• Bump rustls-webpki from 0.103.9 to 0.103.13 in /chess-db #9 — isNonCommercial regex over the free-text credit string. A differently-phrased NC licence (e.g. CC-BY-NC-4.0 without SA) slips through unflagged. Latent today (no catalog source matches), but fragile — promote licence/NC to a real SourceStatus metadata field.
• Bump tar from 0.4.44 to 0.4.46 in /chess-db #10 — Serial enable requests. enableAndImport awaits setSourceEnabled+submitJob strictly one source at a time (2·N round-trips); the per-source work is independent and could be dispatched concurrently to cut the "Enabling…" wait.

(Refuted by the verify pass and intentionally not listed: chooseEmpty wrapper, duplicate AckRow blocks, "free bundles all bulk", and a claimed stuck-enabling re-run state.)

[jozef2svrcek]

Rebased onto #103 (Phase C3) and simplified. This PR is now stacked on the C3 branch, so its diff is just the wizard delta on top of C3.

The wizard's enableAndImport no longer submits a sources_sync per source — with C3's enable→auto-sync, enabling a source (with its credit acknowledgment) is enough; the daemon's scheduler imports it in the background. This removes the explicit sync submission and resolves the earlier review follow-ups #6 (no completion-before-data race driven by the wizard) and #7 (no redundant/duplicate sync jobs).

Merge order: merge #103 first; GitHub will then auto-retarget this PR's base to main.