fix: hardening pass — permissions, socket reconnect, canvas setup, arrangements

- Fix 403 on save for public collection viewers (return role in GET board response)
- Add read-only status indicator (StatusBar + StatusIndicator)
- Fix beforeunload save to use fetch+keepalive with auth header
- Socket reconnect now rejoins board room automatically
- Canvas setup uses polling instead of brittle 200ms timer
- Fix double user:left on disconnect (use disconnecting event, snapshot rooms)
- Thread + comment creation wrapped in db.transaction
- Prevent owner downgrade via addCollectionMember (check existing member)
- Bound redirect depth in downloadImage to 5
- Arrangement operations anchor to bounding box top-left (no drift)
- Distribute H/V also anchor to top-left
- Fix annotations fetch to use axios api instance (401 interceptor)
- Replace require() with static import in shortcut-definitions

backend/routes/collections.js

@@ -263,6 +263,11 @@ router.post('/:collectionId/members', (req, res) => {
       return res.status(400).json({ error: 'Cannot add yourself' });
     }
 
+    const existingMember = getCollectionMember(collection.id, targetUser.id);
+    if (existingMember) {
+      return res.status(400).json({ error: 'User is already a member' });
+    }
+
     addCollectionMember(collection.id, targetUser.id, memberRole);
 
     return res.status(201).json({