fix v1.43.0: external audit P0 — data loss, split geometry, auth, dialog zombies

L2 (silent data loss): debounce gains flush()/pending(); _reloadConfigOnly
flushes a pending write and defers while one is in flight; conflict path
forces; failed reload now toasts instead of an empty catch; teardown flushes.

G1 (split corruption): same-edge cuts carve the niche properly instead of
walking the outline twice; partition invariant (parts sum to the original)
rejects anything else; +1 unit test covering 5 niche shapes and both legacy
cut shapes.

B1 (unauthenticated content): plans and marker files move to
HouseplanContentView (/api/houseplan/content/..., requires_auth); only the
card bundle stays static; contentUrl() rewrites legacy URLs on read (no
storage migration); repairs.py accepts both prefixes; +1 unit test.

L3 (dialog zombies): all four save catch-blocks guard against a closed
dialog; the card no longer blanks when a save fails after Esc.

smokes: smoke_save_race, smoke_dialog_zombie; docs (TESTING/CHANGELOG/
ARCHITECTURE incl. the optimistic-UI note) same-commit

docs/ARCHITECTURE.md

@@ -255,3 +255,20 @@ more specific tier overrides the more general one; "unset" always means
 The UI will later be unified around this model; until then each tier keeps its
 own dialog (general settings gear / space gear / room-card gear / marker
 dialog).
+
+
+## Audit follow-ups (2026-07-27)
+
+- **Content is authenticated.** `/houseplan_files/…` now serves ONLY the card
+  bundle (a Lovelace resource must be public). Plans and marker files go
+  through `HouseplanContentView` (`/api/houseplan/content/<plans|files>/…`,
+  `requires_auth`). `contentUrl()` rewrites legacy stored URLs on read, so no
+  storage migration is needed. Static paths cannot be unregistered — the old
+  routes survive until the next HA restart.
+- **Optimistic UI, stated explicitly (audit L7).** `_serverCfg` is mutated in
+  place before a fallible save in ~22 places and there is no rollback: after a
+  rejected save the UI shows the edit until the next reload. This is a
+  deliberate optimistic-UI choice, not drift. Paths where it is unacceptable
+  need their own rollback.
+- **Split invariant.** `splitRoomPath` guarantees a partition: the two parts'
+  areas sum to the original (within epsilon) or the cut is rejected.