Document the ViGet API in full and take zod 4.6.7 for eslint

The documentation check of the backend found the private members of
ViGet/ without a summary and no page for its namespace:
- Summaries for every field and helper method of the catalog, the
  descriptor, the properties reader, publishing and the endpoints.
- docs/api/namespaces/Progmasoft.Progmaweb.Api.ViGet.md describes the
  namespace.
- The two regular expressions of TazelPluginDescriptor are excluded from the
  reference like AccountNamePolicy.CanonicalPattern: the generator replaces
  their comment with its own.

The dependency audit found GHSA for zod < 4.6.6, which can exhaust memory
while validating oversized constrained collections. Only
eslint-plugin-react-hooks reaches it, and it accepts any zod 4, so an
override takes 4.6.7 until the plugin resolves a fixed release itself.
pnpm audit --audit-level high finds nothing.

2 files changed, 14 insertions, 0 deletions

diff --git a/docs/api/filterConfig.yml b/docs/api/filterConfig.yml
index 5b7b327..ec7ce4f 100644
--- a/docs/api/filterConfig.yml
+++ b/docs/api/filterConfig.yml
@@ -12,3 +12,6 @@ apiRules:
   - exclude:
       uidRegex: ^Progmasoft\.Progmaweb\.Api\.Accounts\.AccountNamePolicy\.CanonicalPattern$
       type: Method
+  - exclude:
+      uidRegex: ^Progmasoft\.Progmaweb\.Api\.ViGet\.TazelPluginDescriptor\.(IdentifierPattern|VersionPattern)$
+      type: Method
diff --git a/docs/api/namespaces/Progmasoft.Progmaweb.Api.ViGet.md b/docs/api/namespaces/Progmasoft.Progmaweb.Api.ViGet.md
new file mode 100644
index 0000000..bb7e94e
--- /dev/null
+++ b/docs/api/namespaces/Progmasoft.Progmaweb.Api.ViGet.md
@@ -0,0 +1,11 @@
+---
+uid: Progmasoft.Progmaweb.Api.ViGet
+summary: *content
+---
+
+<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 -->
+
+ViGet's catalog of Tazel plugins: the plugins and their versions in the account database, the descriptor of a plugin
+JAR, the rules of publishing, the read endpoints under `/api/v1/viget/dslplugins/tazel` with the index Tazel reads, and
+the `viget` commands that publish and yank plugins on the server while publishing is open to Progmasoft alone.