feat(web): the edit surface — /e/<uuid>, live slug change, soft-delete

[daretodave]

Step 05 — the owner's edit surface. Possession of the unguessable UUID edit link is the whole authorization (no account, no session; the token is re-hashed and verified inside the RPC). Loads via get_link_for_edit, saves via update_link, removes via delete_link — the live Step 02 seam, no new backend, no Turnstile.

What ships

• /e/:uuid loads the link behind the token; a dead/expired token → the not-found screen the edge serves.
• Live slug change that never breaks the edit link — the UUID is the stable token, the slug a mutable column. useSlugAvailability gains an optional current arg so the owned slug reads idle (you can't collide with yourself) and fires no lookup; a changed claim checks as before.
• Transport read-only (fixed once minted). Fields mirror create per kind — Server URL for http, the clone/build/run trio for stdio. Fields the surface doesn't show (the other transport's inputs, the description) are preserved on save, never nulled.
• Two-step soft-delete behind a bad-tinted confirm → delete_link → the link 404s from every read → the not-found screen.
• SlugField gains a hint prop so the idle helper fits its surface (create invites a blank; edit reassures a change is safe).
• track.editSave / track.editDelete wired.

Verification

• Composed from the locked edit.jsx mock (design gate lifted) — reuses create's field molecules + the shared components.
• Co-located behavior tests (28 in the edit + slug files) hold the 85% app coverage gate; a hermetic edit-route e2e proves the SPA boots on /e/<uuid>.
• Verified live against the local stack: load → save (name changed, description preserved) → two-step soft-delete → /verify-edit 404s → not-found. Both http and stdio, both themes.

Closes Step 05.