P-B2: Per-entry server-compat and deprecation metadata

[detain]

Summary

Implements P-B2 from the phlix-plugins remediation plan: adds per-entry
server-compatibility and deprecation metadata to the catalog schema and
populates it for all 4 official entries.

Changes

plugins.schema.json — Added 6 new optional properties to the plugin
object (all under the existing additionalProperties: false guard):

• minServerVersion (semver) — minimum Phlix server version required
• maxServerVersion (semver) — maximum supported (exclusive upper bound)
• verified (bool) — whether the entry was reviewed by catalog maintainer
• deprecated (bool) — whether the plugin is deprecated
• yanked (bool) — whether this version has been withdrawn
• deprecationMessage (string) — human-readable deprecation notice

plugins.json — Populated minServerVersion, verified, deprecated,
and yanked for all 4 entries (values read from each plugin's
phlix_min_server_version at its pinned ref):

• anidb: ≥ 0.10.0
• lastfm: ≥ 0.15.0
• myanimelist: ≥ 0.10.0
• trakt: ≥ 0.14.0

README.md — Updated the example JSON, plugin table (adds "Min Server"
column), and the field documentation table.

Notes on remaining items

The remediation plan lists 4 PENDING items. Here is the disposition:

Item	Owner	Status
P-B1 (Honor schemaVersion)	phlix-plugins	✅ Already done — schemaVersion: 2 is enforced as const in the schema
P-B2 (Compat metadata)	phlix-plugins	✅ This PR
SV-S3c (name pattern in CatalogEntry::fromArray())	phlix-server	⏳ Server-side; belongs in phlix-server, not phlix-plugins
SV-S4 (SSRF guard on operator-added catalogs)	phlix-server	✅ Already done — PluginCatalogService::fetchCatalog() calls SsrfGuard::assertPublicUrl() before fetching

SV-S3c and SV-S4 are server-side concerns (SV-* prefix) that belong in
phlix-server, not phlix-plugins. They are tracked separately for the
phlix-server remediation plan.

Verification

# Schema validation (same gate as CI)
npx --yes -p ajv-cli@5 -p ajv-formats@2 ajv validate \
  --spec=draft2020 -s plugins.schema.json -d plugins.json -c ajv-formats

# Sort / dedup check
jq -e '...same as CI workflow...' plugins.json

Both pass.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.