Harden upload lifecycle and renderer recovery

Serialize upload starts across durable audit work, drain in-flight batch additions before cleanup, and fail closed when recovery persistence is incomplete. Wire bounded renderer reload recovery with a branded localized failure surface and use merge-safe fallback log persistence.

lib/upload-start-reservation.js

@@ -0,0 +1,28 @@
+function createUploadStartReservation() {
+  let active = null;
+
+  return {
+    acquire() {
+      if (active) return null;
+      const state = { cancelled: false, released: false };
+      const lease = {
+        isCancelled: () => state.cancelled,
+        release() {
+          if (state.released) return;
+          state.released = true;
+          if (active && active.lease === lease) active = null;
+        }
+      };
+      active = { lease, state };
+      return lease;
+    },
+    cancel() {
+      if (!active) return false;
+      active.state.cancelled = true;
+      return true;
+    },
+    isActive: () => active !== null
+  };
+}
+
+module.exports = { createUploadStartReservation };