fix: deduplicate soundfont scan + source label + delete only uploads

- _scan_soundfonts: dict-keyed by base_id to prevent duplicates
- Add 'source' field ('system' | 'upload') to each soundfont entry
- Delete endpoint: only allow deleting upload soundfonts (403 for system)
- Frontend: show (system)/(upload) tag, hide Delete for system fonts

app/api/v1/plugins.py

@@ -103,14 +103,16 @@ async def upload_soundfont(
 async def delete_soundfont(sf_id: str, current_user: dict = Depends(get_current_user)):
     base_id = sf_id.replace("sf_", "")
     deleted = False
-    for d in [UPLOAD_SF_DIR, os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), "static", "soundfonts")]:
+    for d in [UPLOAD_SF_DIR, os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), "static", "soundfonts"), SYSTEM_SF_DIR]:
         if not os.path.isdir(d):
             continue
         for f in os.listdir(d):
             if os.path.splitext(f)[0] == base_id:
+                # Skip system dir — only allow deleting uploads
+                if d == SYSTEM_SF_DIR:
+                    raise HTTPException(status_code=403, detail="System soundfonts cannot be deleted via this endpoint")
                 path = os.path.join(d, f)
                 os.remove(path)
-                # Remove associated .meta file
                 meta_path = os.path.join(d, os.path.splitext(f)[0] + ".meta")
                 if os.path.isfile(meta_path):
                     os.remove(meta_path)