fix: hardening pass — permissions, socket reconnect, canvas setup, arrangements

- Fix 403 on save for public collection viewers (return role in GET board response)
- Add read-only status indicator (StatusBar + StatusIndicator)
- Fix beforeunload save to use fetch+keepalive with auth header
- Socket reconnect now rejoins board room automatically
- Canvas setup uses polling instead of brittle 200ms timer
- Fix double user:left on disconnect (use disconnecting event, snapshot rooms)
- Thread + comment creation wrapped in db.transaction
- Prevent owner downgrade via addCollectionMember (check existing member)
- Bound redirect depth in downloadImage to 5
- Arrangement operations anchor to bounding box top-left (no drift)
- Distribute H/V also anchor to top-left
- Fix annotations fetch to use axios api instance (401 interceptor)
- Replace require() with static import in shortcut-definitions

backend/socket/board-room.js

@@ -150,16 +150,13 @@ function setupBoardRoom(io, socket) {
 
   // ---- Disconnect cleanup ----
 
-  socket.on('disconnect', () => {
-    for (const room of socket.rooms) {
+  socket.on('disconnecting', () => {
+    const rooms = [...socket.rooms];
+    for (const room of rooms) {
       if (room.startsWith('board:')) {
         leaveRoom(io, socket, room);
       }
     }
-    if (socket.currentBoardId) {
-      const roomName = getRoomName(socket.currentBoardId);
-      leaveRoom(io, socket, roomName);
-    }
   });
 }