fix v1.44.2: external review CR-1..CR-3

CR-1: the lock invariant is restated precisely (never by an accidental
tap; the door card's labeled button is the ONE sanctioned surface),
unlocking now confirms, and smoke_lock_invariant exercises all five
actuation paths (icon tap, controls[], card entities, _cardToggle,
opening card).

CR-2: attachment migration is transactional — the server COPIES files,
the config is committed with its revision check, and only then the old
folder is removed via the new houseplan/files/cleanup. A rejected save
no longer leaves the stored urls pointing at an emptied folder.

CR-3: migrate returns an exact {source: written} mapping; only confirmed
copies are rewritten, destination name collisions get a unique name
instead of silently linking a pre-existing file, and a failed migration
raises a toast instead of being swallowed.

+1 unit test (119), +1 backend test, +1 smoke (51 total); docs
same-commit

test/logic.test.mjs

@@ -792,6 +792,20 @@ test('clampScale', () => {
   assert.equal(clampScale(undefined, 1.5), 1.5);
 });
 
+test('migratePdfUrls: only confirmed copies are rewritten (review CR-3)', () => {
+  const pdfs = [
+    { name: 'a.pdf', url: '/houseplan_files/files/v_old1/a.pdf?v=1' },
+    { name: 'b.pdf', url: '/houseplan_files/files/v_old1/b.pdf?v=2' },
+  ];
+  // сервер скопировал только a.pdf, причём переименовал из-за коллизии
+  const out = migratePdfUrls(pdfs, 'v_old1', 'dev99', { 'a.pdf': 'a (2).pdf' });
+  assert.equal(out[0].url, '/houseplan_files/files/dev99/a%20(2).pdf?v=1');
+  assert.equal(out[1].url, pdfs[1].url, 'нескопированный файл ссылается на старую папку');
+  // пустой маппинг = ничего не переносим
+  assert.deepEqual(migratePdfUrls(pdfs, 'v_old1', 'dev99', {}).map((p) => p.url),
+    pdfs.map((p) => p.url));
+});
+
 test('migratePdfUrls: rebinding rewrites file urls', () => {
   const pdfs = [
     { name: 'a.pdf', url: '/houseplan_files/files/v_old1/a.pdf?v=1' },