Use purchased library for cloud ownership

[Strategizm]

Summary

• fetch the account's PS4/PS5 game library through the current PlayStation mobile OAuth client and purchasedTitlesRetrieve GraphQL operation
• normalize those rows into the shared cloud-catalog ownership model while retaining product, entitlement, concept, platform, and artwork identities
• keep the legacy internal_entitlements flow as a compatibility fallback
• version the unified and owned-library caches so existing installs immediately refetch from the corrected source
• add a regression covering Fortnite's distinct browse SKU, purchased product ID, and stream entitlement ID

Root cause

The existing ownership flow relies exclusively on internal_entitlements. For some accounts that endpoint omits active game-library licenses, particularly free-to-play or add-to-library titles. When the ownership row is absent, Pylux cannot cross-reference the catalog card and incorrectly presents Add Game.

The reproduced case was Fortnite:

• browse catalog: UP1477-PPSA01922_00-FNBNDL0000000000
• purchased product: UP1477-PPSA01922_00-PSCP320000000000
• stream entitlement: UP1477-PPSA01922_00-FORTNITETESTING2

The new source supplies all three structural identities. Existing concept/stable-key matching can then produce one owned card and retain the entitlement required by the PS5 cloud route. No title-specific matching is added.

This addresses an ownership-source gap discussed in #6. It complements the broader catalog work in #25 and #43; those changes improve matching and routing but do not replace the legacy owned-library source.

Resilience

• OAuth or GraphQL failures fall back to the existing entitlement endpoint.
• Only explicit HTTP 401/403 responses are treated as authentication failures.
• GraphQL page metadata is honored when present, and partial results are not cached if the safety page cap is reached.
• Both new and legacy cache keys are invalidated.

User impact

Titles returned by the current purchased-library API but omitted from the legacy entitlement API can now be recognized as owned and streamed. Fortnite is the live-verified regression; the fix is intentionally general and may cover other free-to-play, add-to-library, regional, or alternate-SKU titles with the same ownership-data gap.

Validation

• live verified on macOS with an affected account: Fortnite changed from Add Game to an owned, streamable card
• ./build-arm64/test/chiaki-unit /chiaki/cloudcatalog_merge/fortnite_purchased_library_sku
• ./build-arm64/test/chiaki-unit — 119/119 passing
• current macOS arm64 executable compiles and links successfully
• git diff --check

Local ad-hoc bundle re-signing stopped after compilation because the existing build-output/Pylux.app contains resource-fork/Finder metadata. This is confined to the local packaging artifact; source compilation and linking completed successfully.