V2 P5-backend + P7 + P8: conflict-safe sync, revocable invites, feats, multiclass, tests

P5 backend (the deferred items):
- conflict-aware cloud sync via optimistic concurrency: the server versions each
  backup blob (file mtime) and rejects a push whose base version is stale (409),
  so a second device can't silently overwrite a newer cloud copy. The client
  tracks its last-synced version; the SyncStatusIndicator surfaces a "Sync
  conflict" with one-click resolution (Use cloud / Keep this device), and the
  Settings push offers the same choice.
- revocable invites: owner can rotate a campaign's invite code (kills the old
  one) and remove a member (drops them + deletes their published characters).
  (Skipped editor/player roles — no enforcement target in the current model.)
- image storage: deliberately deferred (live images already stream de-duped on a
  separate channel; a backup blob-store is infra with no correctness gain).

P7 — subclass/feat/multiclass depth:
- feats are now first-class tracked records (name + effect text) in a Feats &
  Features sheet section, not buried in notes. Dexie v15 migration.
- 5e multiclass spell-slot calculator: a pure multiclassSlots() (full ×1, half
  ÷2, third ÷3 → full-caster table) + a sheet control to fill the slot table for
  multiclass casters. (Honest scope: tracking + slots, not per-subclass feature
  automation.)

P8 — test hardening: v2-surfaces e2e (feats, multiclass calc, signals bell,
World nav) + server tests (blob versioning, invite rotation, member removal) +
multiclass unit tests.

Gate green: 283 unit + 35 e2e + 2 realtime. App + server build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/index.ts

@@ -65,17 +65,25 @@ export function buildServer() {
   app.put('/api/save', async (req, reply) => {
     const u = await accounts.userByToken(bearer(req));
     if (!u) return reply.code(401).send({ error: 'unauthorized' });
-    const blob = (req.body as { blob?: string } | undefined)?.blob;
-    if (typeof blob !== 'string') return reply.code(400).send({ error: 'bad-blob' });
-    await accounts.saveBlob(u.id, blob);
-    return { ok: true, size: blob.length };
+    const body = (req.body as { blob?: string; baseSavedAt?: number | null } | undefined) ?? {};
+    if (typeof body.blob !== 'string') return reply.code(400).send({ error: 'bad-blob' });
+    // Optimistic concurrency: if the caller names the version it last synced and
+    // the cloud has since moved on (another device pushed), refuse — no silent
+    // overwrite. The client then resolves (pull, or force-push).
+    const current = await accounts.blobSavedAt(u.id);
+    if (current !== null && body.baseSavedAt !== undefined && body.baseSavedAt !== null && body.baseSavedAt !== current) {
+      return reply.code(409).send({ error: 'conflict', savedAt: current });
+    }
+    const savedAt = await accounts.saveBlob(u.id, body.blob);
+    return { ok: true, size: body.blob.length, savedAt };
   });
   app.get('/api/save', async (req, reply) => {
     const u = await accounts.userByToken(bearer(req));
     if (!u) return reply.code(401).send({ error: 'unauthorized' });
     const blob = await accounts.loadBlob(u.id);
     if (blob === null) return reply.code(404).send({ error: 'no-save' });
-    return reply.header('content-type', 'application/json').send(blob);
+    const savedAt = await accounts.blobSavedAt(u.id);
+    return reply.header('content-type', 'application/json').header('x-saved-at', String(savedAt ?? '')).send(blob);
   });
 
   // ---- shared cloud campaigns + member-owned characters ----
@@ -98,6 +106,17 @@ export function buildServer() {
     if (!c) return reply.code(404).send({ error: 'no-campaign', message: 'No campaign with that invite code.' });
     return { id: c.id, name: c.name, system: c.system, role: c.ownerUserId === u.id ? 'owner' : 'member' };
   });
+  app.post('/api/campaigns/:id/invite', async (req, reply) => {
+    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
+    const code = await cloud.rotateInvite(u.id, (req.params as { id: string }).id);
+    return code ? { inviteCode: code } : reply.code(403).send({ error: 'forbidden', message: 'Only the campaign owner can rotate the invite.' });
+  });
+  app.delete('/api/campaigns/:id/members/:userId', async (req, reply) => {
+    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
+    const p = req.params as { id: string; userId: string };
+    const ok = await cloud.removeMember(u.id, p.id, p.userId);
+    return ok ? { ok: true } : reply.code(403).send({ error: 'forbidden' });
+  });
   app.put('/api/characters', async (req, reply) => {
     const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
     const { campaignId, character } = (req.body ?? {}) as { campaignId?: string; character?: { id?: string; name?: string; data?: string } };