[Remex9]

Pull Request Summary

Closes #451, Closes #452, Closes #453, Closes #454, Closes #455, Closes #456
Related to #444

The open scene is now an in-browser working copy. Edits and imports (direct image uploads and legacy bone imports) change only that copy, and Save stores it as one versioned write. If the stored scene changed somewhere else after it was opened, the save is refused (412) and the user can overwrite it or reload the saved version. A save-status indicator, an unsaved-changes warning (switching scenes, New, Delete, Duplicate, page close), Duplicate, and recovery when the scene was deleted elsewhere are included.

PR Checklist

• Project builds and runs (API server started locally and exercised over HTTP)
• Tests and linters pass (npx jest: 693 passed, 5 skipped; npm run lint clean)
• Any related documentation has been updated, including JSDoc comments or docstrings

Detailed Description

Server (boneset-api/scenes.js)

• New PUT /api/scenes/:id: stores images, annotations and the optional import log in one locked write. A stale baseUpdatedAt returns 412 with the current updatedAt. Versions always increase.
• POST /api/scenes accepts optional content, so "Save as new scene" is a single atomic request.
• New POST /api/scenes/:id/duplicate.
• POST /:id/import-legacy no longer touches storage. It returns { images, annotations, importLogEntry, imported, importedAnnotations, warnings } and places the row at the client-supplied originY.
• DELETE takes the scene lock, so an in-flight save can't bring a deleted scene back. A lock timeout returns 423.
• Content validation: arrays, object shape, image src, 1,000-object limits, total size, import log capped to the last 50 entries.

Client (templates/js/scenes.js, boneset.html, style.css)

• Working copy plus last-saved copy, tracked with revision counters. Edits made while a save is in flight stay unsaved.
• Save button and status (Saved / Unsaved changes / Saving… / Save failed). A save-failure prompt stays visible through later edits.
• Bone imports add their content to the working copy. Imports that finish after a different scene was opened are dropped.

Tests

• Server: PUT, POST with content, Duplicate, the import route leaving storage untouched, DELETE vs. an in-flight save, and validation.
• Frontend: import keeps unsaved edits; import alone writes nothing; save stores edit, import and log together; discard leaves the server unchanged; a real change elsewhere still conflicts; save failures, save-as-new, Duplicate, and the unsaved-changes warnings.

Known limitation: leaving the editor with Back doesn't warn. The working copy stays in memory, and closing or reloading the page does warn.

[mudabs]

Approved.

The implementation is well-tested and meets the requirements for saving and restoring scenes. Automated tests, linting, and SBOM checks pass. The save workflow, conflict handling, duplicate support, import behavior, and scene locking are covered.

The PR is approved from a code-review perspective.