fix(cms): stable bottom bar and self-save no longer trips the 409 lock

MITHOME-68: the optimistic-lock fingerprint was frozen at page load, so the
user's own second save 409'd. /save now returns the hash of the written
content and the client refreshes CONTENT_HASH on success — 409 only fires
for genuine external changes (deploy, other tab, restore). Also: successful
logins no longer consume the auth failure budget (only failed attempts do).

MITHOME-69: bottom bar items no longer shift while saving/publishing — the
status message occupies a constant flex slot (visibility instead of
display), the publish button locks its width while running and restores
its env-specific label, auto margins removed. Layout guard test added.

Test markers are now run-unique so a crashed run can never poison the
next one's expectations.

scripts/test-content-editor-serializer.js

@@ -26,7 +26,7 @@ const fixture = {
 };
 const clientJs = fs.readFileSync('scripts/cms-editor-client.js', 'utf8');
 const html = serverContext.globalThis.renderContentEditor('home', JSON.stringify(fixture), null, 'csrf-test-token', { common: '⚙️ Közös' }, clientJs, 'hash-test-value');
-assert.ok(html.includes('const CONTENT_HASH = "hash-test-value"'));
+assert.ok(html.includes('let CONTENT_HASH = "hash-test-value"'));
 const browserSource = [...html.matchAll(/<script(?: [^>]*)?>([\s\S]*?)<\/script>/g)].at(-1)[1]
   .replace("render(DATA, document.getElementById('editor'));", '')
   .replace("const toast = document.querySelector('.toast');", 'const toast = null;');