[Upstream PR #498] Consume storage:depot in the depot/chunk pipeline (WS4) #104

Context

Tracking the remaining SDK 0.7.0 runtime parity work on the upstream-pr/generic-plugin-spi branch behind Drop-OSS/drop#498.

Ported so far: registerDepotProvider (fail-closed on the storage:depot capability), getDepotProviders()/getDepotProvider(), purge-on-unregister, and the resolveRemoteDepot() / readRemoteRange() helpers with tests (server/server/internal/services/depot/remote.ts).

What is missing is a consumer: nothing calls resolveDepotStream in the upstream branch, so a registered provider is inert. On develop, the consumer chain was delivered via #94 / PR #97 / #99 / #100 / PR #101:

1. Loopback byte-range bridge server/server/api/v1/internal/depot/[gameId]/[depotId]/range.get.ts, guarded by TORRENTIAL_RPC_SECRET + loopback-only peer checks.
2. Rust RemoteVersionBackend in torrential (range streaming into the existing chunk cache).
3. manifest-fetch.ts wiring to populate remoteUrl/remoteHeaders from resolveRemoteDepot.

Scope / decision required

• Decide whether a generic consumer belongs upstream or stays a plugin/drop-seedbox concern. The storage:depot SPI is generic, but the loopback bridge + torrential remote backend are currently tied to the seedbox streaming feature.
• If upstreaming: port the loopback bridge (verifyTorrentialRpcSecret, TORRENTIAL_RPC_SECRET, loopback rejection) and its tests.
• If upstreaming: port the Rust RemoteVersionBackend + create_backend fallback and chunk-cache integration.
• Wire server-side depot resolution where a version has no local backend.
• Ensure the SPI is documented as usable even if the concrete consumer stays external.

Acceptance

A game whose only depot is remote can be served through the host's depot pipeline, or the SPI is explicitly documented as registration-only with consumption owned by external plugins.

References

• Upstream PR: feat: generic plugin runtime SPI, web admin manager, and desktop extension host Drop-OSS/drop#498
• Original (delivered to develop): [plugins] Consume DepotStorageProvider in the depot/chunk pipeline #94, feat: resolve remote depot streams from DepotStorageProvider (#94, sub-phase 1) #97, [plugins] Rust: remote VersionBackend in torrential + chunk cache integration #99, [plugins] Remote depot pieceReader loopback byte-range bridge (TORRENTIAL_RPC_SECRET) #100, feat(depot): implement remote depot streaming pipeline (#94, #98, #99, #100) #101
• External provider: Heretek-Games/drop-seedbox