docs: add Modrinth API upstream entry

UPSTREAMS.md

@@ -19,16 +19,16 @@ This repository tracks GPT execution work across upstream projects.
 ## zlh-api / zpack-api (API / Control Plane)
 - Repo: `https://git.zerolaghub.com/jester/zlh-api`
 - Role: Control-plane orchestration (instance lifecycle, DB writes, agent coordination)
-- Notes: Game telemetry routes live under `/api/game/*`.
+- Notes: Game telemetry routes live under `/api/game/*`. Full mod lifecycle routes added Feb 2026.
 
 ## Portal / Frontend (Next.js)
 - Repo: `https://git.zerolaghub.com/jester/zlh-portal`
-- Role: Customer portal (dashboard, console UX)
+- Role: Customer portal (dashboard, console UX, mod management UI)
 
 ## zlh-agent (Go Agent)
 - Repo: `https://git.zerolaghub.com/jester/zlh-agent`
 - Role: Agent runtime for provisioning/install/verify/start workflows + console PTY
-- Notes: Periodic update checks + Phase 1 mod management + process metrics added Feb 2026.
+- Notes: Periodic update checks + Phase 1 mod management + process metrics added Feb 2026. Host allowlist includes `cdn.modrinth.com` and `artifacts.zerolaghub.com`.
 
 ## Artifacts (Minecraft zpack tree)
 - Location (VM filesystem): `/opt/zlh/zpacks/minecraft/`
@@ -37,6 +37,27 @@ This repository tracks GPT execution work across upstream projects.
 
 ---
 
+## Modrinth API
+
+Used for mod resolution and search.
+
+**Endpoints used:**
+- `GET /v2/project/{id}/version` — fetch compatible versions for a mod
+- `GET /v2/search?facets=` — search mods by loader + game version
+
+**Host allowlist:**
+- `cdn.modrinth.com` — artifact downloads (agent-level)
+- `api.modrinth.com` — API calls (API-level resolver)
+
+**Constraints:**
+- Rate limit: 300 req/min
+- Requires `User-Agent` header
+- Search is loader + game version filtered
+- SHA512 provided on all artifacts (SHA1 fallback)
+- No API key required for public endpoints
+
+---
+
 ## Authentication Ownership
 
 ### Portal