[WilliamRagstad]

The project API now accepts the actual editor draft and core scene formats instead of arbitrary JSON. It reuses immutable upstream loaders: pace_core at 1aa2b36 for scene v1, and the extracted pace_editor_format crate in pace_app at 1dd8f4d for editor draft v1. Accepted payloads are still stored and downloaded byte-for-byte, with the existing transactional ETag/If-Match concurrency and authorization checks.

The upload limit now matches the editor's 64 MiB file limit so embedded backgrounds can travel with a project. Invalid versions, unknown fields, malformed structures and duplicate IDs are rejected; core scenes also receive semantic reference/geometry validation. Editor drafts preserve their existing ability to save incomplete references. No draft-to-core conversion or scene envelope is introduced.

PACE_ALLOWED_ORIGINS enables explicitly configured browser origins, exposes ETag/Location, and permits authenticated project preflights. It defaults to no cross-origin access and rejects wildcard/path/credential origins. Validation runs off the async executor. Documentation covers both formats, browser configuration and the distinction between snapshot sharing and real-time co-editing.

This completes the server side of client integration after the merged storage and authentication PRs (#1 and #2). The companion app PR is pace-kit/pace_app#4, which extracts the shared format without changing it and adds the browser UI and real-server browser tests.

Validation: all 20 server integration tests pass, along with cargo fmt --check and cargo clippy --locked --all-targets -- -D warnings. Tests cover original-byte round trips through both canonical loaders, schema failures, stale/concurrent writes, authorization/revocation, process kill/restart persistence, exact and oversized/chunked limits, and CORS. The app's two-browser test also passed against this server, including image-preserving save/upload/download/save, explicit conflict reconciliation and denied access.

Compatibility: Rust 1.97.1+ is now required by the pinned core dependency. Previously stored arbitrary JSON remains downloadable; new writes require a supported format. Runtime save slots and core export/preview in the draft editor are outside project sharing.