Centralize Zotero NCBI access under PMC Help Desk rules

[jnton]

Why

The PMC Help Desk replied on 7 August 2026 with the concrete requirements for programmatic PMC ID Converter use:

• include both tool and email parameters;
• make no more than three requests per second;
• do not make concurrent requests.

The Zotero plugin still had two independent PMC ID Converter callers, one using a legacy endpoint/tool label, and the default runtime suite included a live NCBI integration test. Repeated CI runs should not generate provider traffic.

Changes

• adds one shared ncbiProvider module used by both item detection and reader-reference resolution;
• uses the current PMC ID Converter endpoint;
• sends tool=NotandiaZotero and email=mario.marcolongo.dev@gmail.com;
• validates identifiers through the shared work-identifier mapper;
• limits batches to 50 identifiers;
• globally serializes every converter request so only one request can be in flight at a time;
• retains a conservative 1.1 second minimum start interval;
• deduplicates identical in-flight requests and caches successful results in memory;
• handles 403/429 cooldowns and Retry-After;
• leaves the NCBI preference fail-closed and disabled by default;
• replaces the live NCBI CI test with deterministic mocks that verify endpoint, tool, email, absence of api_key, and no concurrent requests;
• replaces the live Europe PMC reference-fetch test with a deterministic XML fixture as well;
• updates NCBI provider documentation to record the Help Desk guidance.

Release boundary

No release/tag is created here. After CI passes, manually smoke-test a single enabled PMID/PMCID lookup in Zotero before deciding whether to change the default preference in a later release.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.