feat(cms): optimistic locking against stale-tab overwrites

A Content Editor tab left open across a deploy (or a save from another tab)
held the pre-deploy content; one Save would silently overwrite the newer
file. The editor page now embeds a SHA-256 fingerprint of the file content
at load time, /save requires it back in X-Content-Hash and compares against
the current file: mismatch (or a missing header) answers 409 with an
explanatory message and writes nothing. The client offers a reload on 409.

Integration test covers: matching hash saves, stale hash rejected with the
file untouched, missing hash rejected, retry with the fresh hash succeeds.

Closes MITHOME-61

scripts/test-content-editor-serializer.js

@@ -25,7 +25,8 @@ const fixture = {
   sections: [{ id: 'first', items: ['egy', 'kettő'], settings: { visible: false, weight: 1 } }],
 };
 const clientJs = fs.readFileSync('scripts/cms-editor-client.js', 'utf8');
-const html = serverContext.globalThis.renderContentEditor('home', JSON.stringify(fixture), null, 'csrf-test-token', { common: '⚙️ Közös' }, clientJs);
+const html = serverContext.globalThis.renderContentEditor('home', JSON.stringify(fixture), null, 'csrf-test-token', { common: '⚙️ Közös' }, clientJs, 'hash-test-value');
+assert.ok(html.includes('const CONTENT_HASH = "hash-test-value"'));
 const browserSource = [...html.matchAll(/<script(?: [^>]*)?>([\s\S]*?)<\/script>/g)].at(-1)[1]
   .replace("render(DATA, document.getElementById('editor'));", '')
   .replace("const toast = document.querySelector('.toast');", 'const toast = null;');