v1.50.0: the v1.49.0 review (HP-1490-01..04) and the owner's zoom batch

Owner's batch (committed to dev earlier today, released here):
- devices count as content for the default zoom;
- the editor no longer shifts the plan — the stage measures its own top
  instead of assuming 118px of header;
- zoom goes out to 0.4x, centred.

From the review:
- HP-1490-01: the square-canvas migration wrote two stores in sequence, and
  the first write deleted the aspects the second needed — a crash between
  them stranded the layout in the old coordinates with nothing able to
  finish it. The intent {space: old aspect} is durable now: saved to the
  layout store before anything moves, cleared by the same write that stores
  the migrated layout, each half idempotent behind its own trigger. The
  update event fires only after both halves are on disk. Proven at the exact
  crash boundary by a harness test that fails the layout write once.
- HP-1490-02: check_quota and the file write were two executor jobs with
  nothing between them, so N parallel uploads all measured the store before
  any of them wrote. One job under a dedicated upload_lock now — narrower
  than write_lock on purpose, a directory scan must not stall config saves.
  A failed write reserves nothing.
- HP-1490-03: the content frame fed pan, zoom, clamp AND pointer maths, so
  the editors were boxed into yesterday's drawing. Edit modes measure from
  the full square; mode switches refit rather than carry a view clamped
  against the wrong base.
- HP-1490-04: Save could outrun the proportions read and ship the previous
  file's ratio. Picking a plan clears it immediately; Save awaits the
  bounded read and stores 'unknown' over a lie.
- §5: package-lock version synced, duplicated comment removed.

New: smoke_audit_1490.mjs, migration crash-recovery pure + harness tests,
parallel-quota harness test. Inventory: 138 unit / 49 pure / 40 harness / 64
smokes.

docs/TESTING.md

@@ -239,6 +239,23 @@ Run the *core flows* (marked ★ below) in each environment at least once per mi
       on the plan after a reload. Same for each tap action and each fill mode
       [auto: backend test_every_display_mode_the_editor_offers_is_accepted and
       neighbours, test_a_marker_showing_its_value_can_be_saved]
+- [ ] Editors see the whole canvas (v1.50.0, HP-1490-03): a hand-drawn space
+      with one small room opens content-fit in View; switching to the plan
+      editor shows the full square with room to draw a second room far away;
+      back to View restores the content fit [auto: smoke_audit_1490]
+- [ ] Save waits for a picked plan's proportions (v1.50.0, HP-1490-04): pick a
+      saved plan and hit Save before the thumbnail loads — the stored aspect is
+      the real one, never the previous file's [auto: smoke_audit_1490]
+- [ ] Zoom goes below the fit (v1.50.0): minus past 100% floats the plan
+      centred, floor at 0.4x; entering an editor keeps the stage inside the
+      viewport [auto: smoke_zoom_out]
+- [ ] Migration crash recovery (v1.50.0, HP-1490-01): kill HA between the two
+      store writes of the square migration — the next start finishes the layout
+      half from the saved intent
+      [auto: test_square_migration_finishes_after_a_crash_between_the_writes]
+- [ ] Parallel upload quota (v1.50.0, HP-1490-02): two simultaneous uploads
+      with one slot left — exactly one succeeds
+      [auto: test_parallel_uploads_cannot_slip_past_the_quota_together]
 - [ ] Zoom opens on the content (v1.49.0): a space with no background and one
       small room opens with that room filling the screen, with a small margin.
       With a background it still fits the whole image