fix v1.43.0: external audit P0 — data loss, split geometry, auth, dialog zombies

L2 (silent data loss): debounce gains flush()/pending(); _reloadConfigOnly
flushes a pending write and defers while one is in flight; conflict path
forces; failed reload now toasts instead of an empty catch; teardown flushes.

G1 (split corruption): same-edge cuts carve the niche properly instead of
walking the outline twice; partition invariant (parts sum to the original)
rejects anything else; +1 unit test covering 5 niche shapes and both legacy
cut shapes.

B1 (unauthenticated content): plans and marker files move to
HouseplanContentView (/api/houseplan/content/..., requires_auth); only the
card bundle stays static; contentUrl() rewrites legacy URLs on read (no
storage migration); repairs.py accepts both prefixes; +1 unit test.

L3 (dialog zombies): all four save catch-blocks guard against a closed
dialog; the card no longer blanks when a save fails after Esc.

smokes: smoke_save_race, smoke_dialog_zombie; docs (TESTING/CHANGELOG/
ARCHITECTURE incl. the optimistic-UI note) same-commit

custom_components/houseplan/repairs.py

@@ -11,7 +11,7 @@ from pathlib import Path
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers import issue_registry as ir
 
-from .const import DOMAIN, PLANS_DIR, PLANS_URL
+from .const import CONTENT_URL, DOMAIN, PLANS_DIR, PLANS_URL
 from .store import HouseplanConfigEntry
 
 
@@ -25,9 +25,15 @@ async def async_check_plan_files(hass: HomeAssistant, entry: HouseplanConfigEntr
         res = []
         for sp in spaces:
             url = sp.get("plan_url") or ""
-            if not url.startswith(PLANS_URL + "/"):
+            # both the legacy static URL and the authenticated content URL
+            prefix = None
+            if url.startswith(PLANS_URL + "/"):
+                prefix = PLANS_URL + "/"
+            elif url.startswith(CONTENT_URL + "/plans/_/"):
+                prefix = CONTENT_URL + "/plans/_/"
+            if prefix is None:
                 continue  # external/legacy URL — not ours to verify
-            fname = url[len(PLANS_URL) + 1 :].split("?", 1)[0]
+            fname = url[len(prefix) :].split("?", 1)[0]
             if not (plans_dir / fname).is_file():
                 res.append((sp.get("id", "?"), fname))
         return res