feat(world-builder): register uploaded graphics and extend palette schemas (#6) - #130

📄 api/src/server.ts:962-976
Unlike every sibling admin map endpoint (PUT palette, tiles, publish, discard, revert, permissions), this GET handler never calls requireMapEditSession or requireAdminEmailSession, and there is no global admin auth middleware (confirmed: app.use only does JSON parsing, logging, CORS). Any unauthenticated client can enumerate a map's dynamic palette overrides, including uploaded graphic index assignments. Add an auth guard, e.g. call const authorized = await requireMapEditSession(request, response, mapNum); if (!authorized) return; (or requireAdminEmailSession) before listMapPalette.

📄 api/src/repositories/worldBuilder.ts:619-633
When entry.paletteId is omitted, the next id is derived from SELECT MAX(palette_id)+1. Two concurrent requests for the same mapNum compute the same next_id; the first INSERT succeeds and the second hits ON CONFLICT (map_num, palette_id) DO UPDATE, silently overwriting the just-created entry instead of allocating a new id. Allocate the id atomically (e.g. a per-map sequence, a SERIAL/IDENTITY column, or wrapping the select+insert in a transaction with row locking) so concurrent new entries don't clobber each other.