Audit round 7, web + stages cluster: 13 more verified findings fixed

The web layer's serialization story had three gaps: /api/run started a
stage without the lock, so a decision mid-save could pass the rewrite
guard and still be clobbered by the stage's full rewrite (now the start
itself serializes); /api/photos accepted a replacement photo while
extract was running, permanently pairing the new bytes with the old
photo's reads (now refuses like every other mutation); and /api/queue
read session rows lock-free and stale (now freshens under the lock).
The localhost Host allowlist applied only to writes — a DNS-rebound
page could read pipeline state and shelf photos with plain GETs; it
now covers all methods (foreign-Origin reads still pass: without CORS
headers a cross-origin page can't read the response anyway).

Data-loss finds: the off-BGG edit form re-rendered from games.json,
which only sees hand data after enrich — so a second save resubmitted
pre-save blanks and cleared the first (the detail endpoint now overlays
local_games.json live). The local key embeds the photo list, so a new
sighting orphaned hand-written facts silently; enrich now migrates them
when the title still matches exactly one line, and warns instead of
ever dropping. research() left the previous game's version verdicts on
the row, riding a stale version_id onto the next pick; it clears all
four fields as reopen does. find_row now prefers the version-open
sibling on duplicate keys, mirroring _adopt. Re-adding a removed
hand-added title silently no-opped behind a 200 — it now rescinds the
removal (an explicit undo), and a true duplicate add answers 409.

Smaller: parse_search's dedupe collapsed same-id rows under DIFFERENT
names, discarding the alternate-name row whose exact match downstream
scoring needed (now collapses same-name only; research merges its
ballot per game preferring exact evidence); rpgitems rank in their own
family so their rank parsed null; the pipeline badge counted
review-retired queue rows as pending; the catalog pairing cascade ran
per-entry so a tier-3 claim could steal a sibling's exact row (now
tier-by-tier across all entries, as resolve does); library cards
render a lone player bound without "undefined" and the seats filter
tolerates it; added_no_version reads "done · no version" instead of a
bare green done.

Every finding verified against the code before fixing; each fix
carries a regression test. 337 tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

tests/test_models.py

@@ -173,3 +173,18 @@ def test_parse_things_full_reads_rpggeek_link_vocabulary():
     assert game["categories"] == ["Modern", "Core Rules (min needed to play)"]
     assert game["mechanics"] == ["Card Play"]
     assert game["producers"] == ["Someone"]
+
+
+def test_parse_search_keeps_alternate_name_duplicates():
+    """The same id listed under two NAMES is evidence, not noise — the
+    alternate may be the one that exact-matches the query."""
+    xml = """<items total="2">
+      <item type="boardgame" id="140509">
+        <name type="primary" value="Dragones Y Mazmorras"/>
+      </item>
+      <item type="boardgame" id="140509">
+        <name type="alternate" value="Dungeons &amp; Dragons"/>
+      </item>
+    </items>"""
+    results = parse_search(xml)
+    assert [r.name for r in results] == ["Dragones Y Mazmorras", "Dungeons & Dragons"]