v1.45.1: follow-up review of v1.45.0 — R3-1, R3-2

R3-1 (high): v1.45.0 made the upload safe but left deletion to the client —
after a successful save the card asked the backend to remove everything but the
file it had just committed. Two open editors cannot be ordered: a delayed
request from one deleted the plan the other had just saved, leaving the
accepted configuration pointing at nothing, the exact damage copy-on-write was
introduced to prevent.

houseplan/plan/cleanup is removed. config/set collects inside its own write
lock from the two configurations that bracket the commit (plans.collect_plans):
a file the old revision referenced and the new one does not is superseded and
goes; any other unreferenced upload waits out PLAN_ORPHAN_TTL_S, because a
fresh one may belong to a transaction that has not committed yet. The collector
lives in a pure module so it can be reasoned about and unit-tested without the
HA harness.

R3-2: houseplan-space-card signed its plan url and threw the result away —
getCardSize() mutated a throwaway model while render() rebuilt its own from the
config, so the <image> requested the protected path and got 401 on every
render. Both cards now share ContentSigner (src/signing.ts), which also gives
the static card batching, expiry handling and periodic re-signing.  is
released in finally: one failed request no longer wedges a url for the life of
the page.

Tests: five backend interleaving cases from the report, six unit tests for the
pure collector, smoke_space_card_bg (verified to fail against a v1.45.0 build:
the raw url reaches the DOM and no retry happens). 57 smokes, 124 unit, 22
backend-pure.
Docs: CHANGELOG.md + CHANGELOG.ru.md + ARCHITECTURE.md + TESTING.md + STATUS.md.

docs/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## v1.45.1 — 2026-07-27 (follow-up review of v1.45.0: R3-1, R3-2)
+- **Collecting old plan files moved into the config transaction (R3-1, high).**
+  v1.45.0 made the upload safe but handed the deletion to the client: after a
+  successful save the card asked the backend to remove everything except the
+  file it had just committed. Two open editors could not be ordered — a delayed
+  request from one client deleted the plan the other had just saved, and the
+  accepted configuration was left pointing at nothing, which is the exact damage
+  copy-on-write was added to prevent. The `houseplan/plan/cleanup` command is
+  gone. `config/set` now collects inside its own write lock, comparing the
+  configuration it replaced with the one it accepted: a file the old revision
+  referenced and the new one does not is removed, and any other unreferenced
+  upload is left alone until it is an hour old, because a fresh one may belong
+  to a transaction that has not committed yet.
+- **The static space card shows its plan background again (R3-2).** It signed
+  the url and then threw the result away — `getCardSize()` mutated a throwaway
+  model while `render()` rebuilt its own from the config — so the `<image>` kept
+  requesting the protected path and got a 401 on every render. Both cards now
+  share one signer, which also gives the static card the batching, the
+  expiry handling and the periodic re-signing the main card already had. Its
+  pending set is released in `finally`, so a single failed request no longer
+  wedges a url for the life of the page.
+- New tests: five backend cases for the two-client interleavings from the report
+  (late commit, uncommitted upload, aged orphan, foreign files, rejected save),
+  the collector extracted to a pure module and unit-tested, and
+  `smoke_space_card_bg` for the signed background — it fails on v1.45.0 with the
+  raw url in the DOM.
+
 ## v1.45.0 — 2026-07-27 (external review of v1.44.8: R2-1, R2-2, R2-3)
 - **A rejected save can no longer damage a working plan (R2-1, high).** The
   plan file was written to its final name — deleting the previous extension on