Rackpad 1.8.4-beta.4

This beta candidate finalizes the focused Rack Studio, hardware-template, and
Rack Cabling remediation tracked in #164, #165, #166, #169, #170, and #171.
Schema remains 52. There is no migration, environment-variable, dependency,
or deployment change.

Changes

• Rack Studio applies an initial rack once and then follows room-canvas
  selection. Direct and rack-top placements reject occupied space without
  swapping, displacing, or rewriting existing overlapping inventory. Rejected
  API actions return HTTP 409 with RACK_STUDIO_PLACEMENT_CONFLICT and sanitized
  conflicting-device details.
• Hardware templates place appearance creation in Bays and appearance.
  Port-bearing modules accept 1–16 ports, fans remain portless, and module
  artwork selects and moves its containing position. Existing template JSON v1,
  port IDs, built-in templates, and saved device snapshots remain compatible.
• Rack Cabling keeps selection while panning or zooming and reserves automatic
  fit for structural changes. Manual room layouts have a browser-local,
  lab-scoped lock; missing stored lock values parse as unlocked.
• Automatic routes stay inside a shared room or avoid unrelated room rectangles
  when crossing rooms. Candidate selection prefers safe, non-backtracking routes
  with fewer turns and shorter Manhattan length.
• Smooth Managed routes use exact guide anchors and continuous same-face cubic
  transitions with handles capped at 48 px and 40% of the adjacent leg. Unsafe
  curves shrink or fall back to orthogonal geometry. Live and exported paths
  use the same geometry.

Focused acceptance requested

• #164: create appearance labels and other primitives, create one-, three-,
  and sixteen-port NIC modules, confirm fans create no ports, and drag a module
  through its artwork to move the containing position.
• #165: select a port and cable, pan, wheel-zoom, and use zoom controls; the
  selection and viewport should remain stable until a background click or
  Esc clears it.
• #166: inspect same-room and cross-room automatic routes, then lock a Manual
  room layout and confirm pointer and keyboard movement are disabled.
• #169: open Rack Studio with an initial rack, then select each other rack in
  the upper room canvas and confirm the lower elevation follows every click.
• #170: drag a device onto occupied direct and rack-top space. The red preview
  should name and highlight the occupant; releasing must leave both devices
  visible and unchanged after reload.
• #171: route Smooth Managed cables through brush-panel guides and compare
  the live path with SVG and PNG exports. Orthogonal Managed paths must remain
  right-angled.

Close each focused issue only after its beta confirmation. Record unrelated
feedback in a narrowly scoped follow-up issue.

Data, compatibility, and rollback

Existing overlapping inventory is preserved until a user explicitly moves it.
The action request body and template JSON version are unchanged; the placement
conflict response is the intentional additive contract. Browser-local layout
records without locked remain valid and default to false.

Keep a backup before a later published upgrade. Roll back to the matching prior
application state; do not attach an older application to an unsupported schema.

Validation record

Focused client and server tests cover one-shot rack selection, transactional
placement conflicts, module port counts, layout-lock compatibility, room-aware
routing, exact managed-guide anchors, tangent continuity, and shared export
geometry. Local check:full passed with 349 server tests, 114 client tests, 48
Playwright tests, and 40 screenshot comparisons with zero changed pixels.

An independent security diff review covered all 40 changed source-like files
and found no reportable issue. It confirmed that server/lib/snmp-v3.ts, its
three production importers, credential storage and decryption, monitoring,
sync, and credential-route authorization are unchanged. The existing RFC 3414
review is therefore rebound only to server tree
bcb4a1895f985cbeb4d64875470dc3977ff17477; its source SHA-256, two approved
locations, owner, rationale, and 2026-11-30 expiry remain unchanged. Fresh
hosted quality, CodeQL, and security gates remain required before tagging.