fix(blur): the heid code-review and bug-hunt panels on r2b merge 1, folded

Both panels ran 4/4 on 5ded5ff. They converged on the board and doc-page
gaps independently.

- A board holding files lost both blur controls (they sat inside the
  board suppression meant for the one-click wipe), while its items'
  "◉ booth" labels pointed at them. Only the wipe is board-suppressed now.
- A blurred doc's own full page rendered clear. Its body is blurred there
  too, with its own reveal and a Reveal all to put the blur back.
- set_booth_blurred followed a planted .blurbooth symlink (`touch`), and
  the new control made that a click away. Anything at the name already
  reads as fogged; otherwise it is created O_CREAT|O_EXCL|O_NOFOLLOW.
- The fog landing echoed `back` unchecked into the 303. It is now built
  from the review ring, as the mark routes do.
- The fog form is its own region, so an in-place save refreshes its
  label. Reveal all stays outside every region: its state lives in the
  tab.
- The review's Space-to-advance no longer swallows Space on a focused
  button or link.
- Top-bar controls stay on one line at phone width.
- Tests tightened:
  - method="post" on the fog forms;
  - exact blur values;
  - a storage READ that throws;
  - an item's own reveal carried across a swap;
  - reveal gated where it can act.

r2b.toml: 26/26 proved. 774 passed.

booth/app.py

@@ -136,7 +136,21 @@ def set_booth_blurred(booth: Path, on: bool) -> bool:
     state the caller asked for, exactly as unflagging an unflagged item is."""
     marker = booth / BOOTH_BLUR_FILE
     if on:
-        marker.touch(exist_ok=True)
+        # NEVER through a link (r2b, heid bug-hunt). `touch()` followed a
+        # planted `.blurbooth` symlink: a click rewrote an outside file's
+        # mtime, or created a dangling target — the class `record_view` was
+        # hardened against. Anything already at the name, a link included,
+        # already reads as fogged (`is_booth_blurred`), so there is nothing to
+        # write; otherwise create exclusively, never following a link.
+        try:
+            os.lstat(marker)
+            return True
+        except FileNotFoundError:
+            pass
+        try:
+            os.close(os.open(marker, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o644))
+        except FileExistsError:
+            pass                                   # lost a race to another fog: still fogged
         return True
     try:
         marker.unlink()
@@ -2143,7 +2157,10 @@ def create_app(
         booth = resolve_booth(name)
         set_booth_blurred(booth, on not in ("0", "false", ""))
         landing = f"/b/{quote(name, safe='')}/"
-        if back:
+        # The review only for an item of the review ring (r2b, heid bug-hunt),
+        # exactly as the mark routes' back=view: a stale or foreign `back`
+        # would otherwise land on a 404. Built from the ring, never echoed.
+        if back and back in review_chain(booth_items(booth)):
             landing += f"view?f={quote(back, safe='/')}"
         return RedirectResponse(url=landing, status_code=303)