v1.45.1: follow-up review of v1.45.0 — R3-1, R3-2

R3-1 (high): v1.45.0 made the upload safe but left deletion to the client —
after a successful save the card asked the backend to remove everything but the
file it had just committed. Two open editors cannot be ordered: a delayed
request from one deleted the plan the other had just saved, leaving the
accepted configuration pointing at nothing, the exact damage copy-on-write was
introduced to prevent.

houseplan/plan/cleanup is removed. config/set collects inside its own write
lock from the two configurations that bracket the commit (plans.collect_plans):
a file the old revision referenced and the new one does not is superseded and
goes; any other unreferenced upload waits out PLAN_ORPHAN_TTL_S, because a
fresh one may belong to a transaction that has not committed yet. The collector
lives in a pure module so it can be reasoned about and unit-tested without the
HA harness.

R3-2: houseplan-space-card signed its plan url and threw the result away —
getCardSize() mutated a throwaway model while render() rebuilt its own from the
config, so the <image> requested the protected path and got 401 on every
render. Both cards now share ContentSigner (src/signing.ts), which also gives
the static card batching, expiry handling and periodic re-signing.  is
released in finally: one failed request no longer wedges a url for the life of
the page.

Tests: five backend interleaving cases from the report, six unit tests for the
pure collector, smoke_space_card_bg (verified to fail against a v1.45.0 build:
the raw url reaches the DOM and no retry happens). 57 smokes, 124 unit, 22
backend-pure.
Docs: CHANGELOG.md + CHANGELOG.ru.md + ARCHITECTURE.md + TESTING.md + STATUS.md.

demo/smoke_sign_cap.mjs

@@ -32,7 +32,7 @@ const res = await page.evaluate(async () => {
   for (const p of pdfs) c._display(p.url);
   await new Promise((r) => setTimeout(r, 120));
   out.firstBatches = [...batchSizes];
-  out.signedAfterFirst = Object.keys(c._signed).length;
+  out.signedAfterFirst = Object.keys(c._signer.entries).length;
 
   // переподписывание: все 201, снова батчами, ни одна запись не остаётся старой
   batchSizes.length = 0;
@@ -40,7 +40,7 @@ const res = await page.evaluate(async () => {
   c._resign();
   await new Promise((r) => setTimeout(r, 120));
   out.resignBatches = [...batchSizes];
-  const vals = Object.values(c._signed).map((v) => v.url);
+  const vals = Object.values(c._signer.entries).map((v) => v.url);
   out.allRefreshed = vals.length === 201 && vals.every((u) => u.endsWith('authSig=R2'));
 
   // ссылка, исчезнувшая из конфига, выбывает из кэша и не занимает слот
@@ -50,15 +50,16 @@ const res = await page.evaluate(async () => {
   round = 3;
   c._resign();
   await new Promise((r) => setTimeout(r, 120));
-  out.prunedTo = Object.keys(c._signed).length;
+  out.prunedTo = Object.keys(c._signer.entries).length;
   out.pruneBatches = [...batchSizes];
 
   // протухшая подпись не отдаётся: она вернула бы 401 и «попытку входа»
   const one = pdfs[0].url;
-  c._signed = { ...c._signed, [one]: { url: one + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 } };
+  c._signer.entries[one] = { url: one + '?authSig=OLD', at: Date.now() - 25 * 3600 * 1000 };
   out.expiredNotServed = c._display(one) === '';
+  out.expiredDropped = c._signer.entries[one] === undefined;
   // а стареющая, но ещё живая — отдаётся, пока едет замена
-  c._signed = { ...c._signed, [one]: { url: one + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 } };
+  c._signer.entries[one] = { url: one + '?authSig=AGING', at: Date.now() - 20 * 3600 * 1000 };
   out.agingStillServed = c._display(one) === one + '?authSig=AGING';
   return out;
 });
@@ -71,6 +72,7 @@ checkAll(res, {
   prunedTo: 5,
   pruneBatches: [5],
   expiredNotServed: true,
+  expiredDropped: true,
   agingStillServed: true,
 });
 await finish(browser);