build(frontend): absorb the Community client without moving the Java baseline

[openai0229]

The locked Community frontend sat at a117f489 (v5.3.2-17) while Community main moved 962 commits ahead, so none of the upstream UI work could reach the Rust product.

Moving the submodule to main is not enough: scripts/build-community-h2-classpath.sh requires the checked-out commit's chat2db-community-server tree to equal the Java compatibility baseline recorded in third_party/community-h2-classpath.lock (3cb8af54). The commit currently pinned happens to satisfy both, and every newer Community commit changes the server tree. The first CI run of this branch proved it: Rust-Java IPC, MySQL, and Desktop (windows-latest) failed with Community server tree must match compatibility baseline 3cb8af54cad5bd5caa20bb25f10d9b0e4f01931c.

This change decouples the two pins:

• scripts/community-frontend.lock.json moves to dedc12663 (client tree 9f4be62c090886b726e20fd9bf274d7bd279d5e1).
• third_party/chat2db-community stays on the compatibility baseline commit, so the Java compatibility classpath keeps building from the tree it was validated against.
• scripts/community-frontend.mjs fetches the locked frontend commit into the submodule object store when it is absent (by SHA, then by refs) and archives from the object store. Verification now checks the locked commit's client tree instead of requiring the submodule index and HEAD to equal it; the worktree must still be clean.
• The macOS, Linux, and Windows packaging scripts record community_commit from the frontend lock, which is what scripts/prepare-release.mjs already validates against. Reading it from the submodule HEAD would have failed release aggregation once the two pins diverged.
• docs/architecture.md and docs/releases.md describe the split.

Two mechanical adaptations came with the frontend bump:

• Eight of the eleven pinned upstream behavior scripts were deleted upstream; upstream now runs its own battery through prebuild:web:community, which every community build executes, so the surviving three stay pinned.
• Upstream's test:community-boundary scans the sibling chat2db-community-server tree, which the export now materializes instead of stubbing or skipping.

Verification from this branch:

• npm run verify-upstream: pins dedc12663d8d17eae239f79c2f31205406524aa5 / tree 9f4be62c090886b726e20fd9bf274d7bd279d5e1.
• npm run typecheck, npm test, and npm run build: passed, including the Rust adapter Vitest suite, the Tauri bridge test, the upstream prebuild battery, and upstream verify-production-bundles.
• ./scripts/check-contracts.sh: no drift.
• cargo check -p chat2db-desktop --all-targets --features custom-protocol --locked: passed locally; the desktop jobs also cover it in CI.
• Compatibility guard re-checked by hand: submodule HEAD a117f489 descends from 3cb8af54, its server tree is exactly 45901c60d77b3540a27fec36b8ae5d3ea0b8a47c, the worktree is clean, and no non-LF checkout was found.
• node --test scripts/product-version.test.mjs scripts/prepare-release.test.mjs: 15 passed.

Known gap, intentionally not resolved here

The new client calls 25 backend paths this repository does not implement, and the Rust host answers unknown /api paths with a JSON 404:

• task center /api/tasks/* (10 paths), import preview /api/rdb/import_preview/* (5), driver upload /api/jdbc/driver/upload, active transactions /api/rdb/active_transaction/list, table copy /api/rdb/table/copy/prepare, connection color /api/connection/datasource/identity_color, dynamic database list /api/database/supported, and the /api/v1|v2|v3/ai/* cloud endpoints.

Impact is not uniform: useGlobalData catches the /api/database/supported failure and keeps the built-in database list, while the task center, import preview, driver upload, and active-transaction surfaces have no fallback. The PR stays a draft until the product decision on those endpoints is made.

Review entry points: scripts/community-frontend.mjs, scripts/community-frontend.lock.json, scripts/build-{macos,linux,windows}-package.sh, docs/architecture.md.

AI assistance: implementation, review, and verification performed with Codex.