fix(r2): the heid bug-hunt panel (round "Nyx", 4/4) — triaged and folded

In-place client (base.html):
- Saves are serialized: POST, re-fetch and swap complete before the next
  save starts, so an older snapshot can no longer land after a newer one.
- A form already queued or in flight ignores another submit; a
  double-click writes one note.
- Dirty controls (drafts, unsent radio choices) and disclosures carry by
  identity (form action + hidden ask/target/mark/f + name), not position.
- Any non-tile structural difference, or a page with no region to swap,
  reloads instead of patching.

Server and templates:
- .seen is a JSON array read without following links or blocking,
  regular files of at most 1 MiB only; malformed, nested-too-deep or
  planted markers read as nothing seen.
- landed_at reads symlinks by lstat and skips one unreadable entry
  instead of pinning the booth in "new".
- The Desk counts flags on current items only; orphan flags are listed
  under the tray with an unmark form.
- Agent-written bench and bookmark URLs link only when http(s).
- Audio and video tiles carry a review link.
- A rel the filesystem cannot represent is a 404, not a 500.
- A non-finite Accept q-value fails to parse.
- The standalone marks page has regions and updates in place.
- The review's next arrow sits at the edge at phone width.

Contract amended for each, plus an accepted-risks section (unlocked
.seen read-modify-write, a planted .viewed symlink, Item.ordinal with
no default).

741 passed. Each new browser test was mutation-checked against its fix;
the serialization test forces the race with a held first refresh, since
localhost alone never lost it.

booth/templates/view.html

@@ -138,7 +138,12 @@
     transition:background var(--dur-1) var(--ease-out),border-color var(--dur-1) var(--ease-out)}
   .vnav:hover{background:oklch(0.21 0.01 248 / .92);border-color:rgb(255 255 255 / .3);text-decoration:none;
     color:oklch(0.91 0.008 216)}
-  .vprev{left:0}.vnext{right:360px}
+  /* The next arrow clears the 360px verdict rail only while the rail sits
+     beside the stage. Scoped to the wide layout: stated bare, this rule came
+     later in the page than base.html's narrow override and silently won it,
+     parking the arrow 360px in from the edge of a phone. */
+  .vprev{left:0}.vnext{right:0}
+  @media (min-width:901px){.vnext{right:360px}}
   .vcap{margin-top:10px;max-height:30vh;overflow-y:auto;font-size:var(--size-sm);line-height:var(--leading-body);
     color:var(--text-body);white-space:pre-wrap}
   @media print{.vcap{max-height:none;overflow:visible}.vnav{display:none}}