feat(config): add forced refresh for interval-fetched resources

[mcowger]

Summary

Adds an External Data Refresh section to Network Settings that forces an immediate reload of every interval-fetched resource in one action: OpenRouter / models.dev / Catwalk model metadata, the pi.dev catalog overlay, and the Codex / Claude Code CLI versions. The UI shows live progress while the refresh runs and a per-source result breakdown (counts, provider refreshes, version before→after) when it finishes.

Why / Context

These resources refresh on fixed internal cadences — metadata every 60 minutes, pi.dev every 4 hours, CLI versions every 60 minutes — with no way to force an immediate reload. Waiting out a cadence was the only option when a new model or a fixed catalog entry needed to appear now. The existing "Refresh Metadata" button covered only the three metadata sources, leaving pi.dev and the version services out.

Changes

• Backend route: add POST /v0/management/catalog/refresh-all, which refreshes metadata, the pi.dev overlay (forced), and both CLI versions in parallel, and GET /v0/management/catalog/status for cadence and current counts/versions.
• Version services: CodexVersionService and ClaudeCodeVersionService now return an error string from fetchVersion() instead of silently swallowing failures, and expose their configured auto-refresh interval.
• Failure reporting: version-fetch failures are surfaced in the response and included in hadErrors, so a failed GitHub/npm lookup no longer reports success: true.
• Opt-out respected: refresh-all passes allowNetwork from PLEXUS_MODEL_CATALOG_REFRESH, so the pi.dev network opt-out is honored by the manual path just as it is at startup.
• MCP: add a refresh_catalog operation to plexus_operations, documented in docs/MCP.md.
• Frontend: new self-contained refresh section in NetworkSettings.tsx with an elapsed timer, per-source spinners during the run, and per-source pass/fail rows after; API client and types added alongside it.

Testing

• Added route tests for status output, successful refresh-all, partial catalog failure, version-fetch failure surfacing, and the PLEXUS_MODEL_CATALOG_REFRESH=false opt-out assertion.
• Added version-service tests for the new interval getter and for the returned error string on network / non-OK responses.
• Verified both endpoints against a running dev server (real counts: 526 / 8,295 / 1,695 models, 41 pi.dev providers, live CLI versions).
• Drove the UI in a real browser: confirmed the progress panel with six spinners and elapsed timer, then the green-check result rows matching the API payload.
• bun run typecheck, bun run lint:check, bun run format:check all pass; affected suites 36/36 green.

Notes / Follow-ups

The "Refresh Metadata" card is intentionally left in place — it targets metadata only, while this section covers the full set of interval-fetched resources.

[github-actions]

🔍 OpenCodeReview — detailed findings

⚠️ Review output was unreadable, so the OCR Review check failed. See the run logs for details.