Restrict tldraw mutations to filesystem-backed Terrazzo actions

[dremnik]

Summary

The canvas is intended to be a projection of filesystem entries plus layout metadata, but most stock tldraw mutation actions remain enabled. Delete, Cut, Duplicate, Copy/Paste, and related actions can remove or create item shapes without a corresponding filesystem or sidecar operation.

Evidence

• src/canvas/CanvasView.tsx:36-40 disables only the stock style panel.
• src/canvas/CanvasView.tsx:310-324 intercepts only Backspace and Delete.
• Stock context menus and clipboard behavior remain mounted.
• src/canvas/CanvasView.tsx:330-346 treats added item shapes as layout changes even when their generated IDs do not exist in layout.json.
• Removed shapes are not reconciled to a deliberate filesystem action.

Proposed change

1. Define an explicit allowlist of tldraw operations supported by Terrazzo.
2. Remove or replace stock context-menu, actions-menu, toolbar, clipboard, cut, duplicate, and delete affordances that violate the projection.
3. Disable stock mutation shortcuts and route supported commands through the application keymap.
4. Reject unknown item-shape IDs at the frontend boundary before sending layout deltas.
5. Add a projection invariant check that reconciles unauthorized added or removed shapes from canonical Rust state.
6. Keep pan, zoom, selection, move, resize, rotate, ordering, and layout-only undo where explicitly supported.

Acceptance criteria

• No visible menu or keyboard shortcut can remove a card without the corresponding filesystem command.
• Cut, duplicate, and paste cannot create unknown item IDs or duplicate filesystem-backed cards.
• Move to Trash remains the only card-removal action for live files.
• Moving, resizing, rotating, and ordering known items continue to persist.
• Reloading or reconciling never reveals a divergence caused by a stock tldraw action.
• Automated tests cover context-menu deletion, keyboard deletion, cut, duplicate, paste, and allowed layout mutations.