Preserve reviewed replacement photo across saved-photo removal (#633)

[daliu]

Closes #633

Officer impact: In the preserved future My Account interface, removing the current saved photo no longer silently discards a separate replacement the person is reviewing. The action is explicitly named Remove current saved photo, and keyboard focus returns to the current Remove action, ready Save action, or persistent file input. This connected interface remains unavailable.

Officer documentation: Updated SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the optional-directory Mermaid, one-sentence text alternative, and no-terminal source-evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md.

Deployment evidence: Source/test/merge candidate only. Availability is byte-identical literal false; production remains inert #623 deploy 6a7e072f8f346b0008510d29. No Firebase, Rules, indexes, Functions, provider, account, sign-in, production-data, deployment, or connected/live action is included.

Outcome

• Preserve the current local reading or ready replacement draft across a confirmed saved-photo removal and authoritative readback.
• Keep upload behind later explicit Save, using one new request ID, the exact preserved bytes, and the refreshed revision.
• On unknown outcome or failed post-mutation readback, discard draft bytes/data URL, hide mutation controls, retain only Reload settings, and expose no Save/duplicate-mutation retry.
• Preserve draft on definitive rejection plus successful readback.
• Restore focus in the bounded order: current Remove, current ready Save, persistent file input.
• Preserve all existing app/UID/unmount/reselection/read/render/mutation/readback fences and finder visibility.

Verification

• Trustworthy RED: old runtime erased the ready replacement after confirmed removal.
• Named MEMBERS-DIRECTORY-001H focused Jest: 80/80 passed.
• Full frontend Jest: 18 suites / 1,125 tests passed under Node 20.
• TypeScript --noEmit: passed.
• Scoped ESLint: passed.
• Frontend lint baseline: 120 files / 113 reviewed legacy errors / 6 warnings.
• Diagnostic production build: passed.
• Repository workflow/security/SPA Node suites: 105/105 passed.
• git diff --check: passed.
• Independent security/privacy/race, frontend/accessibility/UX, and backup-officer/operations reviews: GO, no findings.

Exact reviewed head: 38fb2b79665510317aa8ab889627f6b89ece7ea4
Exact tree: 2cbc73167092d83a3d81155e9d3f520cc32b41e0
Exact base/sole parent: d5a218a3ceebdfa758067ae7510803c75564c3c0
Exact six-path binary diff SHA-256: e57f4962c73851f10f4a3e813e76fe6c8136e09fcfb958e0c15e055bfb7454e9

Boundaries

No client-service contract change, inbound WebP validation change, admin-finder change, Account wiring/CSS change, backend/Rules/index/Function change, provider/data/release action, biometric/photo-query behavior, or #507 activation. Active #616 Strava blobs and its separately claimed SECURITY OAUTH-001A2L/RISK-024 hunk are preserved byte-for-byte.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	38fb2b7
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a7e3e66f69c0b00083c3301
😎 Deploy Preview	https://deploy-preview-634--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.