fix(mcp-server): count a one-page view only for that page, and more review fixes

Found by the second PR review:
- get_diagram with a page selector, or a rejected edit's error, counted
  the whole document as seen, so an edit on another page could overwrite
  the user's change there. A one-page view now counts for all pages only
  if the others are unchanged; otherwise the reply says to get them.
- add_page accepted shapes with the root cell ids "0" and "1" and renamed
  them, breaking their edges. The check also missed ids on UserObject
  wrappers and ids written with spaces around the "=".
- Root cells written over two lines were kept as an extra layer, cells
  with id = "a" did not count as cells, and CDATA text before a page's
  model passed the check although draw.io cannot open the page.
- Auto-save cleanup deleted the user's own files that start with mcp-.
  Only names in the session id format are removed now.
- Restoring a history entry dropped edits made in the browser since the
  last entry. They are added to history first.
- A session whose state expired showed a blank page, and the next change
  overwrote its auto-save file. The saved file is loaded instead.
- An edit on a page export's one-page projection, made before the real
  document was back, replaced the whole document.
- A late sync reply could overwrite a newer edit: each sync export is
  numbered, and the server ignores replies older than the current state.
- screenshot_diagram could return another session's image after
  start_session ran during its retries.

packages/mcp-server/src/persistence.ts

@@ -10,6 +10,7 @@ import {
     existsSync,
     mkdirSync,
     readdirSync,
+    readFileSync,
     renameSync,
     statSync,
     unlinkSync,
@@ -54,6 +55,17 @@ export class Autosaver {
         return this.dir ? join(this.dir, `${sessionId}.drawio`) : null
     }
 
+    /** The session's saved diagram, or null. */
+    load(sessionId: string): string | null {
+        const path = this.pathFor(sessionId)
+        if (!path || !existsSync(path)) return null
+        try {
+            return readFileSync(path, "utf-8")
+        } catch {
+            return null
+        }
+    }
+
     schedule(sessionId: string, xml: string): void {
         if (!this.dir) return
         const previous = this.pending.get(sessionId)
@@ -93,10 +105,11 @@ export class Autosaver {
     private removeOldest(): void {
         if (!this.dir) return
         const dir = this.dir
-        // Only our own session files: DRAWIO_DATA_DIR may be a folder
-        // that also holds the user's diagrams
+        // Only our own session files (mcp-<time in base 36>-<random>, made
+        // by start_session): DRAWIO_DATA_DIR may be a folder that also holds
+        // the user's diagrams
         const files = readdirSync(dir)
-            .filter((f) => f.startsWith("mcp-") && f.endsWith(".drawio"))
+            .filter((f) => /^mcp-[0-9a-z]{8}-[0-9a-z]{1,6}\.drawio$/.test(f))
             .map((f) => ({ f, mtime: statSync(join(dir, f)).mtimeMs }))
             .sort((a, b) => b.mtime - a.mtime)
         for (const { f } of files.slice(this.maxFiles)) {