fix: deduplicate soundfont scan + source label + delete only uploads

- _scan_soundfonts: dict-keyed by base_id to prevent duplicates
- Add 'source' field ('system' | 'upload') to each soundfont entry
- Delete endpoint: only allow deleting upload soundfonts (403 for system)
- Frontend: show (system)/(upload) tag, hide Delete for system fonts

app/core/vst_engine.py

@@ -163,12 +163,11 @@ class PluginManager:
         return plugins
 
     def _scan_soundfonts(self) -> list:
-        sfonts = []
-        dirs = [self.sf_dir]
+        sf_map = {}
+        dirs = [("system", self.sf_dir)]
         if self.upload_sf_dir and self.upload_sf_dir != self.sf_dir:
-            dirs.append(self.upload_sf_dir)
+            dirs.append(("upload", self.upload_sf_dir))
         
-        # Load metadata cache for upload soundfonts
         meta_cache = {}
         if self.upload_sf_dir and os.path.isdir(self.upload_sf_dir):
             for f in os.listdir(self.upload_sf_dir):
@@ -180,21 +179,28 @@ class PluginManager:
                     except Exception:
                         pass
         
-        for d in dirs:
+        for source, d in dirs:
             if not os.path.isdir(d):
                 continue
             for f in os.listdir(d):
                 if f.endswith(".sf2") or f.endswith(".sf3"):
                     base_id = os.path.splitext(f)[0]
+                    if base_id in sf_map:
+                        continue
                     meta = meta_cache.get(base_id, None)
                     if meta:
                         display_name = meta.get("original_name", f)
                     else:
-                        # Generate a friendly name from UUID: truncate to first 8 chars
                         short_id = base_id[:8] if len(base_id) > 8 else base_id
                         display_name = f"SoundFont_{short_id}"
-                    sfonts.append({"id": base_id, "name": display_name, "file": f, "display": os.path.splitext(display_name)[0][:40]})
-        return sfonts
+                    sf_map[base_id] = {
+                        "id": base_id,
+                        "name": display_name,
+                        "file": f,
+                        "display": os.path.splitext(display_name)[0][:40],
+                        "source": source
+                    }
+        return list(sf_map.values())
 
     def load_vst(self, plugin_name: str, preset_data: dict = None):
         if not HAS_PEDALBOARD: