feat(mcp,editor): Option A+B storage + 10 agent deliverables (Phase 7)

Ships the combined filesystem/Supabase storage adapter + MCP scene
lifecycle tools + Next.js API routes + editor /scene/[id] route, so
an MCP save is directly openable at /scene/<id> without any
injection hack. End-to-end verified: 10/10 e2e steps pass.

Storage (A1/A2/A3):
- SceneStore interface + error classes + slug helpers
- FilesystemSceneStore at $PASCAL_DATA_DIR (defaults XDG/~/.pascal)
  with atomic writes, .index sidecar, optimistic locking
- SupabaseSceneStore with scenes + scene_revisions tables, RLS
  migration SQL, mock-backed unit tests
- createSceneStore(env) auto-selects based on SUPABASE_URL +
  SUPABASE_SERVICE_ROLE_KEY

MCP tools (A4, A8, A9, A10):
- save_scene / load_scene / list_scenes / delete_scene / rename_scene
- list_templates / create_from_template (3 seed templates:
  empty-studio, two-bedroom, garden-house)
- generate_variants (7 mutation kinds, seeded RNG, save=true|false)
- photo_to_scene (vision sampling → scene graph → save)

Editor (A5, A6):
- /api/scenes + /api/scenes/[id] with RFC 7232 If-Match locking
- /scene/[id] and /scenes route pages with save button, SceneLoader
- Removed the window.__pascalScene dev injection hack

Security + UX edges (A7, A8):
- AssetUrl Zod validator: asset:// blob: data:image/ /path https:
  (http://localhost for dev) + PASCAL_ALLOWED_ASSET_ORIGINS env
  allowlist. Hardens scan.url, guide.url, item.asset.src,
  material.texture.url, MaterialMaps.*Map
- Auto-frame camera on empty→non-empty scene transition
  (camera-controls:fit-scene emitter event)

Shared utilities:
- rehydrateSiteChildren() extracted to packages/mcp/src/lib/ and
  used by both create-from-template and generate-variants to work
  around the SiteNode.children-as-objects vs. ids inconsistency
  (CROSS_CUTTING §2)
- Storage + MCP subpath exports added to packages/mcp/package.json
  (CROSS_CUTTING §4)

Tests: 293 pass / 0 fail across 40 files (was 142 pre-Phase-7).
Biome: clean.

Phase-7 e2e script at packages/mcp/test-reports/phase7-e2e.ts:
MCP HTTP + editor Next.js both point at $PASCAL_DATA_DIR =
/tmp/pascal-e2e, save_scene from MCP, GET /api/scenes/<id> from
editor server, /scenes list page renders all saved scenes, scene
page renders SceneLoader, delete_scene works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/mcp/src/storage/store.test.ts

@@ -0,0 +1,125 @@
+import { describe, expect, test } from 'bun:test'
+import { generateSlug, isValidSlug, sanitizeSlug } from './slug'
+
+describe('sanitizeSlug', () => {
+  test('lowercases input', () => {
+    expect(sanitizeSlug('MyScene')).toBe('myscene')
+  })
+
+  test('converts spaces to hyphens', () => {
+    expect(sanitizeSlug('my awesome scene')).toBe('my-awesome-scene')
+  })
+
+  test('strips non alphanumeric characters', () => {
+    expect(sanitizeSlug('hello@world!_$%scene')).toBe('helloworldscene')
+  })
+
+  test('collapses runs of hyphens', () => {
+    expect(sanitizeSlug('a---b--c')).toBe('a-b-c')
+  })
+
+  test('collapses runs from mixed input', () => {
+    expect(sanitizeSlug('a   b   c')).toBe('a-b-c')
+  })
+
+  test('trims hyphens from the ends', () => {
+    expect(sanitizeSlug('---foo---')).toBe('foo')
+  })
+
+  test('enforces 64-char maximum', () => {
+    const long = 'a'.repeat(200)
+    const result = sanitizeSlug(long)
+    expect(result.length).toBeLessThanOrEqual(64)
+    expect(result).toBe('a'.repeat(64))
+  })
+
+  test('trims trailing hyphen after truncation', () => {
+    const raw = `${'a'.repeat(63)}-bbbbb`
+    const result = sanitizeSlug(raw)
+    expect(result.endsWith('-')).toBe(false)
+    expect(result.length).toBeLessThanOrEqual(64)
+  })
+
+  test('throws when result is empty', () => {
+    expect(() => sanitizeSlug('')).toThrow()
+    expect(() => sanitizeSlug('!!!')).toThrow()
+    expect(() => sanitizeSlug('   ')).toThrow()
+  })
+
+  test('preserves already-valid slugs', () => {
+    expect(sanitizeSlug('already-valid-123')).toBe('already-valid-123')
+  })
+})
+
+describe('isValidSlug', () => {
+  test('accepts typical slugs', () => {
+    expect(isValidSlug('my-scene')).toBe(true)
+    expect(isValidSlug('scene123')).toBe(true)
+    expect(isValidSlug('a')).toBe(true)
+  })
+
+  test('rejects empty string', () => {
+    expect(isValidSlug('')).toBe(false)
+  })
+
+  test('rejects uppercase', () => {
+    expect(isValidSlug('MyScene')).toBe(false)
+  })
+
+  test('rejects underscores and other punctuation', () => {
+    expect(isValidSlug('my_scene')).toBe(false)
+    expect(isValidSlug('my.scene')).toBe(false)
+    expect(isValidSlug('my/scene')).toBe(false)
+  })
+
+  test('rejects leading or trailing hyphens', () => {
+    expect(isValidSlug('-foo')).toBe(false)
+    expect(isValidSlug('foo-')).toBe(false)
+  })
+
+  test('rejects consecutive hyphens', () => {
+    expect(isValidSlug('foo--bar')).toBe(false)
+  })
+
+  test('rejects strings > 64 chars', () => {
+    expect(isValidSlug('a'.repeat(65))).toBe(false)
+  })
+
+  test('accepts exactly 64 chars', () => {
+    expect(isValidSlug('a'.repeat(64))).toBe(true)
+  })
+})
+
+describe('generateSlug', () => {
+  test('returns a 12-char string', () => {
+    const slug = generateSlug()
+    expect(slug).toHaveLength(12)
+  })
+
+  test('is lowercase alphanumeric', () => {
+    for (let i = 0; i < 50; i++) {
+      const slug = generateSlug()
+      expect(slug).toMatch(/^[a-z0-9]{12}$/)
+    }
+  })
+
+  test('passes isValidSlug', () => {
+    for (let i = 0; i < 20; i++) {
+      expect(isValidSlug(generateSlug())).toBe(true)
+    }
+  })
+
+  test('produces unique values across many calls', () => {
+    const seen = new Set<string>()
+    for (let i = 0; i < 200; i++) {
+      seen.add(generateSlug())
+    }
+    // Allow for a tiny chance of collision but near-certain uniqueness.
+    expect(seen.size).toBeGreaterThan(195)
+  })
+})
+
+// Note: createSceneStore() factory branching is covered transitively by
+// the filesystem and supabase store tests. We avoid mock.module() here
+// because bun's module mocks persist process-wide and pollute sibling
+// test files (notably supabase-scene-store.test.ts).