[DWAA1660]

What and why

Fixes #130 and #131. Both come from the same naming rule, so they're one PR: the fix for #131 has to build on the length rule #130 changes.

#130: long names lost their extension. names::safe_file_name cut the whole cleaned name with .chars().take(80). "x"×90 + ".pdf" was saved as 80 x characters with no extension, so media_kind called a long .png Other and the code view stopped recognising PDFs and Office files.

#131: a long name's second copy couldn't be removed. assets::unique_name added -2 after that cut. An 80-character ….txt became an 82-character …-2.txt, and assets::remove (and so page.detach) refused it, because re-sanitising it didn't give the same name back.

Changes in notecraft_model::names:

• MAX_FILE_NAME (80) names the limit.
• split_extension(name) splits off a real extension: up to 16 ASCII letters and digits after the last dot.
• fit_file_name(stem, extension, suffix) joins the parts within the limit by cutting the stem, never the extension or suffix.
• safe_file_name cleans as before (path parts, characters, reserved names), then fits through fit_file_name. Applying it again changes nothing, which is what remove relies on.

assets::unique_name now builds stem-N.ext with fit_file_name, so every copy, however many digits its suffix has, is a safe name that remove accepts.

How it was checked

• New names::tests::a_long_attachment_name_keeps_its_extension:
  • .pdf, .png, .docx and .tar.gz keep their extension at exactly 80 characters, and a name already at the limit is kept
  • extensionless and space-containing names are cut as before
  • a reserved stem made safe still fits
  • safe_file_name is idempotent on a set of tricky names, including multibyte ones
• New names::tests::a_suffixed_name_fits_and_stays_safe: suffixes -2, -10 and -1234 fit with .txt kept, and are safe names
• New assets::tests::long_names_keep_their_type_and_every_copy_can_be_removed: through the real store, long PDF/PNG/DOCX keep their type (a long PNG is MediaKind::Image). Twelve copies of the issue's 80-character .txt all get distinct names and all can be removed.
• cargo test -p notecraft-model -p notecraft-store -p notecraft-engine -p notecraft-import: pass
• cargo test -p notecraft-ui-egui: all pass (302 unit, 200 UI)
• cargo fmt --all -- --check, cargo clippy -p notecraft-model -p notecraft-store --all-targets -- -D warnings: clean

🤖 Generated with Claude Code

[DWAA1660]

Audit finding: the new truncation can turn a valid filename into a reserved Windows device name. Reproduced by compiling this PR's actual crates/model/src/names.rs and calling safe_file_name:

CON-.txt -> CON.txt -> file-CON.txt
AUX-.png -> AUX.png -> file-AUX.png
COM1-.pdf -> COM1.pdf -> file-COM1.pdf

The second arrow is a second call on the result. Main preserves the original names. fit_file_name trims - after is_reserved_name has already checked the stem, so the output is both reserved and non-idempotent. A subsequent operation that validates the stored name can reject it.

Please validate the final truncated/trimmed stem for reserved names (including any safety prefix within the length budget), and add these cases to the idempotence regression. Holding this PR out of the merge batch until fixed.