v1.49.0: content-fit zoom, swipe animation, wording, and the v1.47.0 review

Owner's batch:
- zoom now opens on what is DRAWN (rooms + 5% margin) for spaces with no
  background image; with one the image is the plan and still fits whole. A small
  plan on the square canvas no longer opens as a speck.
- swiping between spaces, and the kiosk carousel, slide sideways; honours
  prefers-reduced-motion.
- the room settings button reads 'Room settings' and lightens on hover.
- 'curation' is filtering everywhere: UI strings, docs, code.

Checked the yard while I was there: its drawing sits off-centre because it was
drawn that way — before the migration x spanned 0.12..0.54 with 0.12 and 0.46 of
margin. The migration added 0.1465 on each side, symmetrically. Content-fit zoom
makes it moot anyway.

From the v1.47.0 review:
- HP-1470-02: the picker let you delete the plan you had just selected — it is
  not in the stored config yet, so the server rightly called it free, and the
  save then stored a url with no file. The button is disabled, and since two
  clients can do this in either order, config/set now verifies every internal
  plan url against the disk under the write lock and answers .
  External and legacy urls are not ours to police.
- HP-1470-01: growth is bounded at the door rather than by deleting old files —
  that mistake cost real plans twice. check_quota refuses an upload that would
  push the store past 256 MB / 200 plans (1 GB / 1000 attachments) or leave less
  than 512 MB free. The plan list is capped at 60 newest with a total, and
  thumbnails load lazily.
- HP-1470-03: picking a saved plan waited for nothing and stored a fallback
  ratio when the signature had not arrived — a square plan came out stretched.
  It waits for the signature, binds the result to the dialog that asked, and the
  dialog preview is signed too.
- report §5: the last lifecycle comments still described age-based collection.

Not released yet — the owner asked for a release once the batch is done.

docs/ARCHITECTURE.md

@@ -10,7 +10,7 @@ houseplan-card/
 ├─ src/                          # card sources (TypeScript + Lit 3)
 │  ├─ houseplan-card.ts          # the card: rendering, states, drag, tooltip, sticky header
 │  ├─ editor.ts                  # GUI config editor (ha-form + selectors)
-│  ├─ rules.ts                   # icon rules (iconFor), curation, groups, domain priority
+│  ├─ rules.ts                   # icon rules (iconFor), filtering, groups, domain priority
 │  └─ data/
 │     ├─ house.ts                # geometry: ROOMS (rooms→area), FLOOR_VB (viewBox), names
 │     └─ backgrounds.ts          # VECTOR plans (SVG base64) + FLOOR_BG_RECT (positioning)
@@ -266,12 +266,21 @@ removes nothing. Deciding what may then go is *not* a client's call — a cleanu
 request cannot be ordered against another client's commit, and a delayed one
 deletes a plan that was just saved. So `config/set` collects itself, inside its
 write lock, from the pair of configurations that bracket the commit
-(`plans.collect_plans`): superseded files go immediately, other unreferenced
-uploads only once `PLAN_ORPHAN_TTL_S` has passed, since a fresh one may belong
-to a transaction still in flight. The `.` between id and token is load-bearing —
+(`plans.collect_plans`): a file the commit REPLACED goes immediately, and
+nothing else goes at all — see the table above; only a per-dialog staging folder
+ages out. Growth is bounded at the door instead, by `plans.check_quota` on every
+upload (store size, file count, free disk), because a limit that deletes is how
+plans were lost twice. The `.` between id and token is load-bearing —
 a space id cannot contain one, so `<space>.<token>.<ext>` can never be confused
 with the files of a space whose name merely starts the same way.
 
+**An internal plan url must exist when it is stored** (HP-1470-02). The picker
+can attach a plan and then delete it, and two clients can do the same in either
+order — the write lock orders the requests but says nothing about whether the
+file survived. `config/set` therefore checks every `/api/houseplan/content/plans/`
+url against the disk before saving, and refuses with `missing_plan`. External and
+legacy urls are the user's own and are never second-guessed.
+
 **Signed content urls are batched, aged and deduplicated** (reviews R2-2, R3-2, R4-2). `ContentSigner`
 in `src/signing.ts` is the single implementation, used by both cards; the
 duplicate inside houseplan-space-card signed correctly and never handed the
@@ -312,7 +321,7 @@ Shared, framework-light modules keep the two views from diverging:
   `roomCenter`, `defaultPositions`, `markerPos`, `labelPos`; no Lit import) — unit-tested,
   mirrors the full card's private geometry.
 - `src/space-render.ts` — `renderSpaceStatic()` draws the plan + configured room
-  borders/names + device markers (via `buildDevices`, same curation) with NO handlers,
+  borders/names + device markers (via `buildDevices`, same filtering) with NO handlers,
   NO live states, NO status/temperature fills. Uses the same CSS classes as the full card
   (the space-card imports `cardStyles`) for visual parity.
 - `src/config-store.ts` — module-level `{config, rev, layout}` cache shared by all embedded