fix: older defects (batch C) and the second batch's review

Chats:
- New Chat right after an answer saves that chat once. Saves run one at
  a time and read the chat on screen when their turn comes; a save
  scheduled for a chat that is no longer on screen is dropped. A chat
  whose id was still on its way to the URL no longer comes back after
  New Chat (the next answer went into it).
- Crossing the 768 px breakpoint keeps the chat panel: a streaming answer,
  unsaved messages and attachments stay. The panel gets the sizes of each
  side, and a panel collapsed on desktop opens on mobile.
- The chat's export waits for its own reply: an edit's history export
  still on its way no longer answers it with the older diagram, and two
  file saves at once no longer swap results.
- A second edit in one answer is previewed on the first edit's result.
- Stop also ends a running screenshot check; a chat that cannot be saved
  (storage full) can be left with "Continue without saving".
- Small diagrams with shapes count as diagrams; the tool card no longer
  crashes on malformed operations.

Quota and providers:
- Requests that reach the server's own endpoints count toward the quota:
  EdgeOne (always its own endpoint now), a private base URL whatever key
  header is sent, keyless Ollama without a URL. With the quota on, a
  redirect is followed only to a public address. The output cap applies
  to these requests too.
- Stop records the tokens of the steps that finished; the screenshot check
  counts its tokens without counting a request.
- EdgeOne configured only by AI_PROVIDER works, also in the admin Test,
  which forwards the access code. Azure set up only in the admin panel
  works in chat. The Test sends a Bedrock session token.
- The admin panel's Test of an entry without a URL uses the server's URL
  as the server does (no private address check for it); the admin panel
  no longer writes an Ollama URL.

MCP server:
- Write tools and start_session run one at a time, so two at once never
  drop each other's change; a cancelled call waiting its turn is skipped.
  get_diagram and export_diagram keep the session they started with.
- Export to .drawio first gets the user's latest edits from the browser.
- History thumbnails: one that arrives after the next AI write is
  dropped; a sync reply keeps the image; a version that changed only page
  settings is its own entry.
- A diagram over the 10 MB limit is saved without its image, or the user
  is told to download it (the server now answers 413 instead of cutting
  the connection).
- Labels holding text like id='1' or parent='1' are no longer read as
  attributes (a layer or a parent was deleted). A broken bare
  <mxGraphModel> file is refused.
- After a sync reply the tab no longer sends its autosave copy again.

Desktop and files:
- A newer switch of the same preset is not rolled back by an older one
  that failed. .env values with escaped quotes are read whole.
- MCP saved files: a file that could not be read stays protected while a
  folder without permission hides it, and is saved again once deleted.
- The desktop app reports "no chats" only when the count was read and no
  model settings are stored.

packages/mcp-server/tests/xml-validation.test.ts

@@ -326,3 +326,30 @@ describe("text directly under a page", () => {
         expect(r.error).toMatch(/not-base64/)
     })
 })
+
+describe("attributes inside quoted values", () => {
+    const labelled = `<mxCell id="2" value="Use parent='1'" vertex="1" parent="1"><mxGeometry as="geometry"/></mxCell>`
+
+    it("are not duplicates of the real ones", () => {
+        const r = validateAndFixXml(model(labelled))
+        expect(r.valid).toBe(true)
+        expect(r.fixed ?? model(labelled)).toContain(labelled)
+    })
+
+    it("are kept when a real duplicate is removed", () => {
+        // The bare & makes the repair run on the whole document
+        const cell = `<mxCell id="3" value="Use parent='1'" vertex="1" parent="1" parent="1"><mxGeometry as="geometry"/></mxCell>`
+        const r = validateAndFixXml(model(cell + BROKEN_CELL))
+        expect(r.valid).toBe(true)
+        expect(r.fixed).toContain(
+            `<mxCell id="3" value="Use parent='1'" vertex="1" parent="1">`,
+        )
+    })
+
+    it("leave two cells with an unbalanced quote their ids and parents", () => {
+        const broken = `<mxCell id="4" style="rounded=1;fillColor="#dae8fc" vertex="1" parent="1"><mxGeometry as="geometry"/></mxCell><mxCell id="5" value="B" vertex="1" parent="1"><mxGeometry as="geometry"/></mxCell>`
+        const r = validateAndFixXml(model(broken))
+        expect(r.fixed).toContain(`id="5" value="B" vertex="1" parent="1"`)
+        expect(r.fixed).toMatch(/id="4"[^>]*vertex="1" parent="1"/)
+    })
+})