feat(cms): optimistic locking against stale-tab overwrites

A Content Editor tab left open across a deploy (or a save from another tab)
held the pre-deploy content; one Save would silently overwrite the newer
file. The editor page now embeds a SHA-256 fingerprint of the file content
at load time, /save requires it back in X-Content-Hash and compares against
the current file: mismatch (or a missing header) answers 409 with an
explanatory message and writes nothing. The client offers a reload on 409.

Integration test covers: matching hash saves, stale hash rejected with the
file untouched, missing hash rejected, retry with the fresh hash succeeds.

Closes MITHOME-61

content-editor.js

@@ -274,6 +274,18 @@ const server = http.createServer(async (req, res) => {
           return;
         }
         const data = JSON.parse(body);
+        // Optimistic locking: the editor echoes the fingerprint of the content it
+        // loaded. If the file changed since (deploy, another tab, git), a blind
+        // save would silently overwrite those changes — reject with 409 instead.
+        const clientHash = req.headers['x-content-hash'];
+        const currentOnDisk = fs.readFileSync(FILES[activeFile], 'utf8').trim();
+        const currentHash = crypto.createHash('sha256').update(currentOnDisk).digest('hex');
+        if (typeof clientHash !== 'string' || clientHash !== currentHash) {
+          writeAudit('content_saved', { clientAddress, user: CMS_USER, file: activeFile, result: 'conflict' });
+          res.writeHead(409, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: 'A tartalom megváltozott, mióta ezt a lapot megnyitottad (pl. deploy vagy másik fül mentett). Frissítsd az oldalt, és végezd el újra a módosításokat.' }));
+          return;
+        }
         const validation = validateContent(activeFile, data);
         if (!validation.ok) {
           writeAudit('content_saved', { clientAddress, user: CMS_USER, file: activeFile, result: 'validation_failed' });
@@ -335,9 +347,14 @@ const server = http.createServer(async (req, res) => {
   } catch (e) {
     message = { type: 'err', text: 'Fájl olvasási hiba: ' + e.message };
   }
+  // WHY: fingerprint of the file content at page load. The editor sends it back
+  // on save (X-Content-Hash); a mismatch means the file changed since this tab
+  // was opened (deploy, another tab, git) and a blind save would silently
+  // overwrite those changes.
+  const contentHash = crypto.createHash('sha256').update(jsonData).digest('hex');
 
   res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-  res.end(HTML(activeFile, jsonData, message, CSRF_TOKEN, FILE_LABELS, clientJs));
+  res.end(HTML(activeFile, jsonData, message, CSRF_TOKEN, FILE_LABELS, clientJs, contentHash));
 });
 
 if (require.main === module) {