merge issue-89-metadata-lock → main (Create-string model, #89/#90)

Drop the metadata_locked column + "Save and lock" UI end-to-end. The
review endpoint now builds the deterministic title/short_description on
every call; the owner's Create title / Create short desc buttons fire
the build and write the result (force-overwrite contract). commitReview
auto-fills only empty fields (no owner-clobber) and folds the
deterministic copy into its single PUT (kills the client_rev 409
cascade).

Taken wholesale from the branch: photo strip, wood primary/secondary,
server-side thickness band (hidden from UI, passed to Woo on publish),
and fixes #80/#82/#83/#84.

- backend: remove metadata_locked from schema.sql, db sentinels,
  slabs.py client fields/exposure, review.py lock action; review
  always computes title/short_desc
- frontend: slabs.ts + Review.svelte drop the lock model, add
  Create-string workflow + wood primary + photo strip
- e2e: m3-create + review-photo-strip rewritten for the Create-string
  contract; thickness-band test asserts absence (per #90)
- deploy: recreate LAN binds (override-m3.yml was absent); verify
  metadata_locked gone, review builds title, PUT persists

Gates: backend 117/117, unit 88/88, tsc clean, e2e 6/6 (m3-create +
photo-strip). Live UAT verified at 192.168.1.202:10881.

backend/slabs.py

@@ -65,9 +65,10 @@ def _encode(payload: Dict[str, Any]) -> Dict[str, Any]:
     return out
 
 
-# #89: server-managed — only the explicit review lock action may set it. A plain
-# PUT must not flip the lock (the deterministic copy is built inside that action).
-CLIENT_FORBIDDEN_FIELDS = {"metadata_locked"}
+# #89: server-managed fields that a plain client PUT must not set directly.
+# (metadata_locked was dropped — the deterministic title/short-desc are built by
+# the review endpoint and written back by the client's Create buttons.)
+CLIENT_FORBIDDEN_FIELDS = set()
 
 
 def _row_to_slab(row) -> Dict[str, Any]:
@@ -78,8 +79,6 @@ def _row_to_slab(row) -> Dict[str, Any]:
                 d[f] = json.loads(d[f])
             except (ValueError, TypeError):
                 pass
-    # #89: expose the lock flag to the client (0/None → False, 1 → True).
-    d["metadata_locked"] = bool(d.get("metadata_locked"))
     return d