v1.45.2: hardening from the v1.45.1 review — R4-1, R4-2

R4-1: collecting superseded plan files runs after the configuration is already
durable, but an error listing the directory propagated out of config/set. The
client saw a failure for a revision the server had committed, and its retry
came back as a conflict. collect_plans now reports 0 instead of raising, and
config/set logs and proceeds — the event fires, the revision is returned.

R4-2: the pending set was cleared when a batch went out, not when it came back,
so every render during an in-flight content/sign queued another request: six
calls where one was needed, and unbounded on a socket that is slow rather than
busy. Queued and in-flight are separate states now; a failure backs off (2 s
doubling to 60 s) instead of retrying on the next frame; an in-flight entry
expires after 15 s so a promise that never settles cannot wedge retries; a late
answer after dispose() no longer renders.

Tests: test/signing.test.mjs — eight cases with hand-settled promises, verified
against a v1.45.1 checkout where four of them fail (2 sign calls instead of 1,
no backoff, a late answer rendering after teardown). Backend: a broken
collector still yields a successful save whose revision the next CAS accepts.
Pure collector: a disappearing directory returns 0.
Docs: CHANGELOG.md + CHANGELOG.ru.md + ARCHITECTURE.md + TESTING.md + STATUS.md.

docs/ARCHITECTURE.md

@@ -194,7 +194,7 @@ to a transaction still in flight. The `.` between id and token is load-bearing
 a space id cannot contain one, so `<space>.<token>.<ext>` can never be confused
 with the files of a space whose name merely starts the same way.
 
-**Signed content urls are batched and aged** (reviews R2-2, R3-2). `ContentSigner`
+**Signed content urls are batched, aged and deduplicated** (reviews R2-2, R3-2, R4-2). `ContentSigner`
 in `src/signing.ts` is the single implementation, used by both cards; the
 duplicate inside houseplan-space-card signed correctly and never handed the
 result to its renderer, which is the failure mode a second copy invites. `MAX_SIGN_PATHS`
@@ -204,6 +204,10 @@ signatures carry the time they were issued — an aging one keeps rendering whil
 its replacement is fetched, an expired one is dropped rather than served (it
 would 401 and raise a failed-login warning). The cache is pruned to the urls the
 live config references, so it cannot grow past the cap through history alone.
+Queued and in-flight are distinct states: a render happening while a request is
+out must not queue the same url again, a failure backs off rather than retrying
+on the next frame, and an in-flight entry expires after `SIGN_INFLIGHT_MS` so a
+promise that never settles cannot block retries forever.
 
 **Room climate is one pass per hass snapshot** (review R2-3). `areaClimateMap()`
 classifies the whole registry once and returns `Map<area, {temp, hum}>`; the