Pull the catalogue from a real endpoint, with delta sync

Replaces the last simulation on the inbound side. RemoteCatalogueSource
returned SeedData after a fake progress bar; there was no wire format, no
endpoint, and no way to receive an update short of reinstalling.

Wire format (data/remote/catalogue_wire.dart)
- Tolerant where it should be: a catalogue of 4,000 products must not fail to
  import over one absent emoji, so optional fields take defaults and an
  unrecognised category files under Grocery — the item still scans, prices and
  bills.
- Strict where it matters: no id, name, barcode or price and the import fails.
  A silently dropped product is a shelf item that scans to nothing, discovered
  with a queue waiting.
- GST accepts 18 or 0.18 and reads both the same. Back offices disagree about
  which they mean, and getting it wrong silently changes the tax on every line.

HTTP source with paging and deltas
- GET {base}/catalogue?since={revision}&page={n}. Paged because a supermarket
  catalogue is tens of thousands of rows: one response times out on a shop's
  line and stalls the UI decoding it. Capped at 200 pages so a bad deployment
  cannot become an infinite request loop against a shop's connection.
- `since` carries the revision already held, so a normal morning fetches a
  handful of price changes rather than the whole book. A server that cannot do
  deltas ignores it and answers is_delta:false — the terminal reads the flag
  rather than assuming, so both work.
- A bad credential is non-retryable and says so, leaving the working catalogue
  in place so billing continues.

Applying deltas without losing local state
- A full snapshot withdraws what it omits; a delta must not. Read as a
  snapshot, the first morning price change would empty the shelf.
- Retired products are marked inactive, not deleted — order lines already
  recorded point at them, and a hard delete would orphan a bill's history.
- Locally registered shoppers survive a pull, as before.
- The unsynced-stock replay is now scoped to the products the pull actually
  overwrote. It exists because a server count predates local sales; running it
  over a delta that never carried that product would subtract those units a
  second time and quietly empty a shelf that is full. Both halves of that rule
  are tested.

MQTT stays the nudge, not the transport: a catalogue push on
pos/{store}/catalogue makes every terminal pull immediately, but the rows come
over HTTP, because a broker is the wrong shape for tens of thousands of them.

Tests: 210 -> 234. docs/sync-contract.md now covers both directions, including
a field-by-field table of what happens when something is missing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lib/app/providers.dart

@@ -7,7 +7,9 @@ import '../core/services/sound_service.dart';
 import '../data/datasources/local_store.dart';
 import '../data/repositories/customer_repository_impl.dart';
 import '../data/repositories/product_repository_impl.dart';
-import '../data/datasources/remote_catalogue_source.dart';
+import '../data/remote/catalogue_source.dart';
+import '../data/remote/http_catalogue_source.dart';
+import '../data/remote/simulated_catalogue_source.dart';
 import '../data/remote/http_order_transport.dart';
 import '../data/remote/mqtt_order_transport.dart';
 import '../data/remote/order_transport.dart';
@@ -48,13 +50,31 @@ final transactionRepositoryProvider = Provider<TransactionRepository>(
 /// purpose, which reads as a real network fault.
 final simulateOfflineProvider = StateProvider<bool>((ref) => false);
 
-/// Simulated back-office endpoints. Held as singletons so the offline toggle
-/// in Settings affects every call.
-final remoteCatalogueProvider = Provider<RemoteCatalogueSource>(
-  (ref) => RemoteCatalogueSource(
-    isOffline: () => ref.read(simulateOfflineProvider),
-  ),
-);
+/// Where products and customers come from.
+///
+/// Rebuilt when the route changes, and the old one closed, so a re-pointed
+/// terminal does not keep a stale client alive.
+final catalogueSourceProvider = Provider<CatalogueSource>((ref) {
+  final config = ref.watch(syncConfigProvider);
+
+  final source = switch (config.transport) {
+    // MQTT carries the *notification* that the catalogue moved; the catalogue
+    // itself is a bulk pull, which is an HTTP job. A broker is the wrong shape
+    // for tens of thousands of rows.
+    TransportKind.http || TransportKind.mqtt =>
+      config.httpBaseUrl.isEmpty
+          ? SimulatedCatalogueSource(
+              isOffline: () => ref.read(simulateOfflineProvider),
+            )
+          : HttpCatalogueSource(config: config),
+    TransportKind.simulated => SimulatedCatalogueSource(
+        isOffline: () => ref.read(simulateOfflineProvider),
+      ),
+  };
+
+  ref.onDispose(source.dispose);
+  return source;
+});
 
 // ------------------------------------------------------------------- Sync
 /// How this terminal reaches the back office.
@@ -102,7 +122,7 @@ final orderTransportProvider = Provider<OrderTransport>((ref) {
 final syncRepositoryProvider = Provider<SyncRepository>(
   (ref) => SyncRepositoryImpl(
     ref.watch(localStoreProvider),
-    ref.watch(remoteCatalogueProvider),
+    ref.watch(catalogueSourceProvider),
     ref.watch(orderTransportProvider),
     batchSize: ref.watch(syncConfigProvider).batchSize,
   ),