fix: hardening pass — permissions, socket reconnect, canvas setup, arrangements

- Fix 403 on save for public collection viewers (return role in GET board response)
- Add read-only status indicator (StatusBar + StatusIndicator)
- Fix beforeunload save to use fetch+keepalive with auth header
- Socket reconnect now rejoins board room automatically
- Canvas setup uses polling instead of brittle 200ms timer
- Fix double user:left on disconnect (use disconnecting event, snapshot rooms)
- Thread + comment creation wrapped in db.transaction
- Prevent owner downgrade via addCollectionMember (check existing member)
- Bound redirect depth in downloadImage to 5
- Arrangement operations anchor to bounding box top-left (no drift)
- Distribute H/V also anchor to top-left
- Fix annotations fetch to use axios api instance (401 interceptor)
- Replace require() with static import in shortcut-definitions

frontend/src/canvas/sync.ts

@@ -259,13 +259,24 @@ export function setupSync(
   socket.on('element:remove', onElementRemove);
   socket.on('object:transform', onTransformReceived);
 
-  // ---- Join room ------------------------------------------------------------
+  // ---- Join room (and rejoin on reconnect) ----------------------------------
 
-  socket.emit('board:join', { boardId }, (response: any) => {
-    if (response?.users) {
-      socket.emit('room:users', { users: response.users });
-    }
-  });
+  function joinRoom() {
+    socket.emit('board:join', { boardId }, (response: any) => {
+      if (response?.users) {
+        socket.emit('room:users', { users: response.users });
+      }
+    });
+  }
+
+  // 'connect' fires on both the initial connection and every reconnect,
+  // ensuring the server always has this client in the board room.
+  socket.on('connect', joinRoom);
+
+  // Emit immediately if already connected (socket was connected before setupSync ran).
+  if (socket.connected) {
+    joinRoom();
+  }
 
   // ---- Return handle --------------------------------------------------------
 
@@ -278,6 +289,7 @@ export function setupSync(
     },
     cleanup: () => {
       sceneManager.onChange = prevOnChange;
+      socket.off('connect', joinRoom);
       socket.off('scene:update', onSceneReceived);
       socket.off('element:update', onElementUpdate);
       socket.off('element:remove', onElementRemove);