feat(r2): C5 the lightbox, and the in-place client

- On a gallery booth the marks panel moves into a sticky verdict aside
  beside the set. The aside comes first in the document, so a narrow screen
  stacks the question above the work; grid areas place it on the right when
  wide. Nothing in an ordered collection moves. Boards are unchanged.
- The flag tray lists flagged items by tile number: the declared change
  from the panel list's (created, id). The standalone marks page keeps the
  list.
- Inline group headers are divs, never figure.item.
- Every mark-dependent element is a data-region: the verdict, each tile,
  the rail's filter counts. There is also a server-rendered status line.
- The in-place script (base.html) POSTs with an explicit JSON Accept, then
  on 204 swaps every region from a fresh GET. Live media and per-viewer view
  state are carried across the swap, so there is no layout jolt and no
  stopped track. It never re-POSTs: on failure it says so and reloads. Tile
  controls re-bind after a swap, and the grid cursor survives it.
- The `n` key opens the tile's closed note disclosure before focusing it.
- test_embed_browser's keyboard-flag test expected a navigation, which is
  the defect R2 removes. It is updated as declared in the contract, and
  tightened: a window marker must survive, proving no reload.

Browser tests: flag in place, with no reload and no scroll jump, and the
tile, tray and rail count all updated; and a failed save that reloads
without re-POSTing. Two mutations turn them red (no carry, no rail region).
700 passed.

booth/app.py

@@ -1139,6 +1139,12 @@ def create_app(
                     it["name"]: marks_for_target(marks, it["name"]) for it in gallery
                 },
                 "booth_marks": marks_for_target(marks, None),
+                # R2 C5: the flag tray — the flagged items in SET order, i.e.
+                # by ordinal, over the full gallery (a filter hides tiles, not
+                # judgments). Order is total with no tie-break: rels are unique.
+                "tray": [it for it in gallery if it["name"] in {
+                    m.target for m in marks if m.shape == "flag" and m.error is None}],
+                "ord_width": len(str(len(gallery))),
                 "uploaded": (booth / UPLOAD_MARKER).exists(),
                 # The same provenance line the index card carries. Deliberate:
                 # a booth URL handed to the operator lands HERE, never on the