fix v1.44.4: audit follow-up B2, B5, L4 sub-item

B2: the HTTP upload view failed OPEN when the config entry was
unavailable while the WS path failed closed — both now share one
may_write() policy helper (new auth.py) that denies non-admins when the
policy cannot be read.

B5: _finite now guards room rects, polygon vertices, view_box and
opening coordinates, not just layout positions; the declared
MAX_OPENINGS cap is finally enforced.

L4 (sub-item): every drag pipeline captures the pointer through the
tolerant helper (an inactive pointerId used to kill device/label/resize
drags); decor shapes gained a bounds clamp so they cannot be dragged far
outside the plan and persisted there.

+2 backend tests (16); both changelogs updated in this commit

custom_components/houseplan/websocket_api.py

@@ -17,6 +17,7 @@ from .const import (
     CONF_ADMIN_ONLY, DEFAULT_CONFIG,
     CONTENT_URL, PLANS_DIR, PLANS_URL,
 )
+from .auth import may_write
 from .store import HouseplanData, get_data, get_entry
 from .validation import (
     CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_PLAN_BYTES,
@@ -56,18 +57,8 @@ def _runtime(hass: HomeAssistant, connection, msg_id: int) -> HouseplanData | No
 
 
 def _check_write(hass: HomeAssistant, connection) -> bool:
-    """May this connection write?
-
-    Fails CLOSED (audit B2): when the entry cannot be read — during a reload or
-    while the integration is disabled — the policy is unknown, and "unknown" is
-    not the same as "permissive". Previously this returned True and ws_plan_set,
-    which never touches the runtime helper, accepted uploads in that window.
-    """
-    entry = get_entry(hass)
-    if entry is None:
-        return bool(getattr(connection.user, "is_admin", False))
-    admin_only = bool(entry.options.get(CONF_ADMIN_ONLY, False))
-    return connection.user.is_admin if admin_only else True
+    """May this connection write? Thin wrapper over the shared policy."""
+    return may_write(hass, getattr(connection, "user", None))
 
 
 # ---------------- layout ----------------