Document the ViGet API in full and take zod 4.6.7 for eslint

The documentation check of the backend found the private members of
ViGet/ without a summary and no page for its namespace:
- Summaries for every field and helper method of the catalog, the
  descriptor, the properties reader, publishing and the endpoints.
- docs/api/namespaces/Progmasoft.Progmaweb.Api.ViGet.md describes the
  namespace.
- The two regular expressions of TazelPluginDescriptor are excluded from the
  reference like AccountNamePolicy.CanonicalPattern: the generator replaces
  their comment with its own.

The dependency audit found GHSA for zod < 4.6.6, which can exhaust memory
while validating oversized constrained collections. Only
eslint-plugin-react-hooks reaches it, and it accepts any zod 4, so an
override takes 4.6.7 until the plugin resolves a fixed release itself.
pnpm audit --audit-level high finds nothing.

1 files changed, 19 insertions, 0 deletions

diff --git a/apps/api/ViGet/PostgresTazelPluginCatalog.cs b/apps/api/ViGet/PostgresTazelPluginCatalog.cs
index 07fa86f..9ae20b0 100644
--- a/apps/api/ViGet/PostgresTazelPluginCatalog.cs
+++ b/apps/api/ViGet/PostgresTazelPluginCatalog.cs
@@ -15,6 +15,7 @@ internal static class ViGetSchema
     /// <summary>Key of the advisory lock that lets one process at a time change these tables.</summary>
     private const long MigrationLockKey = 0x5669476574;
 
+    /// <summary>The steps, in order. The version of a step is its position, counted from one.</summary>
     private static readonly string[] Steps =
     [
         // 1: Tazel plugins and their versions.
@@ -101,6 +102,12 @@ internal static class ViGetSchema
         return taken;
     }
 
+    /// <summary>Runs statements that return nothing.</summary>
+    /// <param name="connection">The connection to run them on.</param>
+    /// <param name="transaction">The transaction they belong to.</param>
+    /// <param name="sql">The statements.</param>
+    /// <param name="cancellationToken">Cancels the operation.</param>
+    /// <returns>A task that completes when the statements have run.</returns>
     private static async Task ExecuteAsync(
         NpgsqlConnection connection,
         NpgsqlTransaction transaction,
@@ -116,6 +123,7 @@ internal static class ViGetSchema
 /// <param name="dataSource">Connections to the database of the accounts.</param>
 internal sealed class PostgresTazelPluginCatalog(NpgsqlDataSource dataSource) : ITazelPluginCatalog
 {
+    /// <summary>The columns of a plugin row, in the order <see cref="ReadPlugin"/> reads them.</summary>
     private const string PluginColumns = "publisher, name, description, authors, license, homepage, repository";
 
     /// <inheritdoc/>
@@ -265,6 +273,10 @@ internal sealed class PostgresTazelPluginCatalog(NpgsqlDataSource dataSource) :
         return await command.ExecuteNonQueryAsync(cancellationToken) == 1;
     }
 
+    /// <summary>A plugin from a row of <see cref="PluginColumns"/>.</summary>
+    /// <param name="reader">A reader on the row.</param>
+    /// <param name="versions">The versions of the plugin.</param>
+    /// <returns>The plugin.</returns>
     private static TazelPlugin ReadPlugin(NpgsqlDataReader reader, IReadOnlyList<TazelPluginVersion> versions) => new(
         reader.GetString(0),
         reader.GetString(1),
@@ -275,6 +287,13 @@ internal sealed class PostgresTazelPluginCatalog(NpgsqlDataSource dataSource) :
         reader.IsDBNull(6) ? null : reader.GetString(6),
         versions);
 
+    /// <summary>The versions of a plugin, newest publication first.</summary>
+    /// <param name="connection">The connection to read on.</param>
+    /// <param name="transaction">The transaction to read in, if any.</param>
+    /// <param name="publisher">The publisher of the plugin.</param>
+    /// <param name="name">The name of the plugin.</param>
+    /// <param name="cancellationToken">Cancels the operation.</param>
+    /// <returns>The versions.</returns>
     private static async Task<IReadOnlyList<TazelPluginVersion>> VersionsAsync(
         NpgsqlConnection connection,
         NpgsqlTransaction? transaction,