feat(editor): graph-pulse on errors + store-aware install / add-source

Three connected improvements to the analyzer-driven diagnostics:

  - **Pulsing halo on broken graph nodes**. Every step / pseudo-
    node (inputs / outputs) carrying an analyzer issue now
    breathes a red (error) or amber (warning) halo on the graph
    tab — operator sees the problem on the canvas without
    flipping to text. Honours prefers-reduced-motion: reduce-
    motion users get a static halo at the same intensity. The
    canvas reads severity via a new `stepIssueSeverity` map on
    FlowEditorController; pseudo-nodes use `__inputs__` /
    `__outputs__` sentinel ids.

  - **Store-aware install button**. The analyzer now takes a
    second closure, `storeCapabilities`, listing what the public
    store can install. Unknown-capability issues only carry the
    "Install …" quick-fix when the bare cap is in that list;
    otherwise the issue carries an "Add source for …" fix
    instead. Resolves the asymmetry the operator reported: the
    Store didn't show `htw.digiscout/onet.lookup` but the editor
    happily offered to install it (and would have failed). The
    install path no longer lies about itself.

  - **Did-you-mean suggestion**. When the unknown cap is within
    edit-distance two of an installed or store cap (different
    spelling — distance-0 stays hidden because that's an install
    case, not a typo), the analyzer emits a `ReplaceLineValueFix`
    suggesting the closest match. Preserves the version
    constraint by reusing the installed spec when present
    (e.g. `text.echi@^0.1` → `text.echo@^0.1`).

New public surface:

  - `AddModuleSourceFix` + `AddModuleSourceCallback`
  - `FlowEditorPage.storeCapabilities` + `onAddModuleSource`
  - `FlowAnalyzer.stepSeverity` + the `kInputsNodeId` /
    `kOutputsNodeId` sentinels
  - `FlowIssueSeverity` enum + `FlowNode.issueSeverity`

Tests:
  - Install fix only when in store
  - AddModuleSourceFix as fallback when not in store
  - Did-you-mean replaces install when a near miss exists
  - stepSeverity populated for both step ids and pseudo-nodes

All 36 editor tests green. Bumped to 0.18.0.

Signed-off-by: flemming-it <sf@flemming.it>

lib/src/flow_yaml_controller.dart

@@ -27,15 +27,41 @@ import 'quick_fix.dart';
 import 'wire_colors.dart';
 
 class FlowYamlCodeController extends CodeController {
-  FlowYamlCodeController({List<String> Function()? availableCapabilities})
-    : super(
-        text: '',
-        language: yaml,
-        analyzer: FlowAnalyzer(
-          availableCapabilities:
-              availableCapabilities ?? (() => const <String>[]),
-        ),
-      );
+  FlowYamlCodeController({
+    List<String> Function()? availableCapabilities,
+    List<String> Function()? storeCapabilities,
+  }) : super(
+         text: '',
+         language: yaml,
+         analyzer: FlowAnalyzer(
+           availableCapabilities:
+               availableCapabilities ?? (() => const <String>[]),
+           storeCapabilities: storeCapabilities,
+         ),
+       );
+
+  /// Set both capability providers in one go. Re-creating the
+  /// analyzer is the simplest way to flip both closures without
+  /// risking a stale storeCapabilities reference inside an old
+  /// FlowAnalyzer instance.
+  void setCapabilityProviders({
+    required List<String> Function() available,
+    List<String> Function()? store,
+  }) {
+    analyzer = FlowAnalyzer(
+      availableCapabilities: available,
+      storeCapabilities: store,
+    );
+  }
+
+  /// Worst-severity per step / pseudo-node from the analyzer's
+  /// last pass. Graph canvas reads this to decide which step
+  /// nodes pulse red / amber. Returns an empty map when the
+  /// active analyzer isn't a [FlowAnalyzer].
+  Map<String, IssueType> get stepSeverity {
+    final a = analyzer;
+    return a is FlowAnalyzer ? a.stepSeverity : const {};
+  }
 
   /// Published when the pointer enters a wavy-underlined range.
   /// The editor host (FlowEditorPage) listens and renders an