Contain production capabilities, remove the production sync surface, and keep legacy media/export/transport implementations test-only.
Require authenticated existing-key storage with preservation-first recovery and sticky write disablement, backed by deterministic fault and concurrency tests plus dependency and workflow contracts.
- Use WidgetRef::borrow_mut/borrow directly for the DocEditor host
(new Widget derive: borrow has no generics on refs, as_* only on
WidgetRefExt; WidgetExt blanket impl covers View lookups).
- Semicolon fix for RefMut temporary lifetime in set_rich_mode.
Whole-tree sync: cad-core/cad-ui split sources, nigig-build
construction_frame migration, pdf port progress, mpesa/pay/uikit/doc
updates, workspace members/profiles/lock, CI workflows and reviews.
See individual file history for details.
