Removable reference curves, audit fixes across pages, shaded Academy art

The planner's Artisan .alog drawer now shows what's attached with a
"Remove reference curve" control (re-rendered per drawer open), so adding
a reference curve is no longer a one-way door; /api/alog shares the 8 MB
body cap so real-sized logs parse instead of failing with "bad_request".

Deep-evaluation fixes: editing a brew of an archived bean no longer
silently detaches the bean; the roasts pending-review poll no longer
wipes in-progress after-roast edits; roasters gain an Edit (rename/model)
action; the gear page refuses to autosave over a failed load; duplicating
a plan carries its custom name; cupping sessions can attach a plan after
creation (ownership-checked PUT + selector); admin user deletion also
refreshes plans/audit; cupping cup-count subtitle stays live; roasts
error-row colspan corrected. Regression tests cover the new cupping PUT
and the /api/alog body cap.

Academy scenes drop the flat paper-cutout look: shared defs provide
radial-gradient shading on every bean/half-bean/particle, flame gradients
with radiant halos, soft ground shadows, and a warm-lit stage background;
fill-shift animations now ride a partial-opacity tint overlay so shading
survives the color change.

Co-Authored-By: Claude Fable 5 <[email protected]>

test/cupping.test.js

@@ -210,3 +210,53 @@ test("cupping: delete removes the session, and deleting the linked plan nulls ro
 	);
 	assert.equal((await agent.get(`/api/cupping/${session.id}`)).status, 404);
 });
+
+test("cupping: a plan can be attached after creation, with ownership enforced", async () => {
+	const { app } = await setup();
+	const owner = request.agent(app);
+	const attacker = request.agent(app);
+	const { csrf } = await signup(owner, "[email protected]");
+	const { csrf: attackerCsrf } = await signup(attacker, "[email protected]");
+	const planId = await bootstrapPlan(owner, csrf);
+	const foreignPlanId = await bootstrapPlan(attacker, attackerCsrf);
+
+	const session = (
+		await owner.post("/api/cupping").set("x-csrf-token", csrf).send({ cupCount: 3 })
+	).body.session;
+	assert.equal(session.roastPlanId, null);
+
+	// A PUT without roastPlanId leaves the link untouched
+	const noTouch = await owner
+		.put(`/api/cupping/${session.id}`)
+		.set("x-csrf-token", csrf)
+		.send({ data: session.data });
+	assert.equal(noTouch.status, 200);
+	assert.equal(noTouch.body.session.roastPlanId, null);
+
+	// Attaching my own plan works
+	const linked = await owner
+		.put(`/api/cupping/${session.id}`)
+		.set("x-csrf-token", csrf)
+		.send({ data: session.data, roastPlanId: planId });
+	assert.equal(linked.status, 200);
+	assert.equal(linked.body.session.roastPlanId, planId);
+
+	// Someone else's plan is refused and the link stays intact
+	const cross = await owner
+		.put(`/api/cupping/${session.id}`)
+		.set("x-csrf-token", csrf)
+		.send({ data: session.data, roastPlanId: foreignPlanId });
+	assert.equal(cross.status, 404);
+	assert.equal(
+		(await owner.get(`/api/cupping/${session.id}`)).body.session.roastPlanId,
+		planId,
+	);
+
+	// Explicit null detaches
+	const detached = await owner
+		.put(`/api/cupping/${session.id}`)
+		.set("x-csrf-token", csrf)
+		.send({ data: session.data, roastPlanId: null });
+	assert.equal(detached.status, 200);
+	assert.equal(detached.body.session.roastPlanId, null);
+});

test/roasts.test.js

@@ -326,3 +326,19 @@ test("roasts are private to their owner", async () => {
 		.send({ roastPlanId: plan.body.plan.id, filename: "x.alog", content: makeAlog() });
 	assert.equal(crossPlan.status, 404);
 });
+
+test("reference-curve parse endpoint accepts a real-sized (multi-MB) .alog", async () => {
+	const { agent } = await setup({}, { evaluateRoast: evaluationStub() });
+	const { csrf } = await signup(agent, "[email protected]");
+	// Real Artisan logs carry full telemetry arrays and legitimately exceed 1 MB —
+	// /api/alog must share the enlarged body cap that /api/roasts already has.
+	const doc = JSON.parse(makeAlog("Big log"));
+	doc.padding = "x".repeat(2 * 1024 * 1024);
+	const res = await agent
+		.post("/api/alog")
+		.set("x-csrf-token", csrf)
+		.send({ filename: "big.alog", content: JSON.stringify(doc) });
+	assert.equal(res.status, 200);
+	assert.equal(res.body.ok, true);
+	assert.equal(res.body.roast.title, "Big log");
+});