[DWAA1660]

What and why

Fixes #158. inkpad::Pad::save_plain (Draw › Save picture) always wrote ink-picture.svg beside the page with fs::write, silently replacing any file already there: an earlier export kept on purpose, or an unrelated file with that name.

It now writes to the first free name of ink-picture.svg, ink-picture-2.svg, ink-picture-3.svg, … (up to 10,000, then it reports an error). Each candidate is opened with OpenOptions::create_new, so a taken name is refused atomically and never written over. app.ink_export_plain already reports the returned path ("Saved the drawing as a picture: …"), so the user sees which file was made.

This picks the issue's "generate a unique snapshot name" option. A Save As dialog could be added later, but would be a larger UI change.

How it was checked

• inkpad::tests::ink_is_written_beside_the_page_and_comes_back_as_strokes, extended: with an owner's file already at ink-picture.svg, Save picture writes ink-picture-2.svg and leaves the owner's bytes unchanged. A third save writes ink-picture-3.svg.
• The UI test that clicks Save picture on a fresh page still finds ink-picture.svg.
• cargo test -p notecraft-ui-egui: all pass (302 unit, 200 UI)
• cargo fmt --all -- --check, cargo clippy -p notecraft-ui-egui --all-targets -- -D warnings: clean

🤖 Generated with Claude Code

[DWAA1660]

Audit finding: this changes Save picture from the browser's virtual std::fs::write to std::fs::OpenOptions::create_new, but the browser shim does not implement OpenOptions.

Checked .github/web-build/web.diff and patches.yaml: the virtual fs re-exports native fs items and supplies its own read/write/File implementations; there is no OpenOptions override. A probe using the actual shim with its patched File implementation produces:

virtual fs read: Ok("virtual ink")
OpenOptions::new().write(true).create_new(true).open(virtual_path): NotFound
patched virtual File::open succeeds: true

On wasm the inherited native OpenOptions cannot write the virtual notebook, so the new export path will fail. Please provide a virtual exclusive-create operation (with a matching browser test) or isolate the native implementation behind a platform boundary. Holding this PR out of the merge batch for this browser regression.