feat(models): support multiple Hugging Face sources per node

[DrHepa]

Summary

• add an optional, backwards-compatible model_sources contract for model nodes that require weights from multiple Hugging Face repositories
• resolve download plans from the installed manifest in Electron main and download all declared sources sequentially through one aggregate action
• validate source destinations and collisions, aggregate progress, and apply existing pause/resume/cancel controls to the whole node action
• require every declared check for readiness and keep all downloaded sources owned by the existing node model directory

Legacy hf_repo, download_check, and filter fields keep their existing behavior when model_sources is absent. The new contract is intentionally limited to Hugging Face repositories.

Testing

• npm test
• ./node_modules/.bin/tsc --noEmit
• ./node_modules/.bin/electron-vite build
• python -m compileall -q api
• git diff --check

Validation gap

• no live Hugging Face download or packaged Windows UI E2E was run

Closes #273