Add editable templates, layer controls, and image aspect-ratio locking - #372

…nk (#447)

doc.assets was append-only. Add images, delete every slide, save — and the
"empty" deck was still 20 MB (#442), because deleting an element removes the
reference and nothing ever removed the bytes. A deck could only ever grow.

The fix lives in slides' own save facade, which now shadows serializeAuto and
serializeFile with wrappers that hand the kernel a COPY of the document with
unreferenced assets removed. The kernel never learns the slides document
shape; the live document is never touched, so undo after a save still brings
an image back and the next save keeps it. Every path that writes a .bento.html
from this app goes through the facade: ⌘S write-back, the download fallback,
the four export copies, and window.bento.serialize().

referencedAssetKeys enumerates every form the format has rather than walking
generically, because the format uses two conventions — `asset:<key>` on
image/media src and media poster, and BARE keys on svg.asset, code's
grammar/theme ids and fonts[].asset — and a walk that knew only one would
delete the other. That enumeration is the cost of this change and the rig pins
each form individually; a count would pass with the wrong six surviving.

blobs (the live-collab offload map) follows assets to the same key set.

Measured, matched pair on the same scenario (one image plus two orphaned
1 MB assets, then delete everything and save):
  main:    3.74 MB / 3 assets  ->  3.74 MB / 3 assets
  patched: 1.75 MB / 1 asset   ->  0.75 MB / 0 assets

test-export-secrets' serializeFile call-site guard is made precise rather than
looser: it now matches a CALL and not a `function serializeFile(` DEFINITION,
which is what the facade wrapper is. Verified by injecting a fresh plain call
into autosave.ts — the guard still fails on it.

Under live collaboration the CRDT syncs assets per key, so pruning the saved
copy cannot lose a peer their asset. The one gap is documented at the
function: a file that pruned K, reopened, then received a peer's op
re-referencing K shows that image broken on that replica only, until re-added.

Prior art: 1eevy's #372 addresses the same bug as one part of a larger
save-time compactor (dedupe, key renaming, data-URI interning) bundled with
three UI features and a kernel hook, and is deferred to a later release. This
is the narrow fix and does not preclude that landing later.