[WilliamRagstad]

The browser editor can now exchange complete projects through pace_server while retaining its local save/open workflow and existing pace-editor-draft v1 format. A Project sharing panel accepts an in-memory bearer token and server URL, uploads a private project, grants/revokes reader/writer access, and downloads snapshots for an explicit open/reconciliation decision.

Updates use the ETag belonging to the downloaded/uploaded snapshot. If Alice and Bob both edit revision 1, Bob's successful upload produces revision 2; Alice gets a clear conflict and keeps her edits and original revision. Downloading the latest snapshot does not replace local work or advance the upload precondition. Alice explicitly opens it or confirms keeping local edits against that downloaded revision before uploading. There are no automatic retries, background synchronization, merges or live co-editing.

The existing model/loader is extracted unchanged into pace_editor_format for use by both the app and server. Embedded images, stable IDs, dialogue, inventory and unfinished references retain their local-file behavior. Tokens, remote IDs and ETags never enter project JSON or browser recovery; tokens clear on reload. Requests require HTTPS outside loopback, refuse redirects/cookies, limit response size to 64 MiB and time out after 30 seconds. Late responses cannot attach a revision to a newly opened document, and edits made during an upload remain open.

Companion server PR: pace-kit/pace_server#3 (schema validation, matching upload limit and explicit browser origins). CI builds the immutable server revision 66203da9bfeda679dac0669fe4eae7ced9d9e59e and starts it with an isolated temporary database/test identities for Playwright. This is the third step after the merged storage and authentication changes.

Validation passed locally:

• 18 app/model/session tests, formatting, Clippy with warnings denied, and the WASM target check.
• Release Trunk build and all 6 browser tests, including existing authoring/recovery/rehearsal flows.
• Two isolated browser clients save/upload/download/save the entire three-room fixture with identical JSON/assets, resolve a stale revision explicitly, reject invalid credentials and revoked access, and preserve local work on malformed/late downloads.
• The companion server's 20 integration tests cover schema errors, concurrency, access control, oversized/chunked bodies and real process-restart persistence.

Documentation includes setup and a two-client walkthrough and distinguishes project sharing from real-time co-editing. Core scene v1 is now available and is validated by the server, but the draft editor does not silently convert to it: core runtime preview/export remains a separate integration.