feat(templates): GUI template authoring + per-instance template folders

[Xander-git]

Summary

Lets operators author Copier templates entirely in the GUI, and scopes templates per instance so each created project/run carries its own template folder. Implements the approved design at docs/superpowers/specs/2026-05-30-template-authoring-gui-design.md.

The hierarchy stays equipment → project → run (no new "experiment" level). Single feature commit on top of main (which already includes the distribution/#23 work).

What's included

GUI template authoring (new template/ service layer, pure / no NiceGUI):

• manifest.py — typed TemplateManifest with round-tripping from_yaml/to_yaml (now hosts TemplateQuestion/template_questions; templates.py re-exports them).
• lint.py — single source of validation (LintFinding error/warn) factored out of TemplateEngine.resolve, plus a Jinja2 .jinja parse check. resolve re-raises the same TemplateLoadError/TemplateCoreFieldRedeclaredError on the same conditions (regression-tested).
• authoring.py — atomic writes via atomic_write_bytes; one _safe_target path-traversal chokepoint (reuses paths.project_name_violations); upload size/count caps; opt-in .jinja; stale-edit guard.
• ui/pages/template_editor.py + /templates/edit route; manager gains a per-row Edit action and a scope/location selector.

Per-instance template folders (.exlab-wizard/templates/{equipment|project|run}/):

• resolution.py — nearest-wins chain (project → equipment → global), run-scope narrowing, TemplateChoices bundle, reconcile_selection.
• provenance.py — after CACHE_WRITE, copies the rendering template into the instance's own typed subfolder; creation.json gains template.provenance_path (CREATION_JSON_VERSION 1.9 → 1.10). POST_VALIDATE skips .exlab-wizard/ so the frozen copy isn't validated as run output.

Reactive wizard wiring:

• Project/run wizards re-resolve their template list from the operator's equipment/project selection and submit the resolved absolute path (not templates_dir/name), so a per-instance template renders the right source. A review-caught bug — a same-named per-instance override leaving the stored path stale — is fixed via the shared reconcile_selection helper.

Robustness

Validate-on-save/lint · atomic & safe writes · path-traversal + upload caps · don't-break-templates-in-use (frozen provenance copy + version-bump guard). Copier stays unsafe=False/skip_tasks=True.

Testing

New units: lint / authoring / manifest / resolution / provenance; editor + mount UI; a creation-provenance integration test. Verified per-suite (sync excluded — known flakiness): 425 tests pass (template 143, mount 185, wizards 13+13, editor 8, templates-page 20, controller-integration 43). uvx ruff check + format --check clean.

uv run --extra test pytest tests/unit/template tests/unit/ui/test_mount.py \
  tests/unit/ui/test_template_editor.py tests/integration/controller

Out of scope (spec §7 — future work)

Raw-YAML advanced editor tab · equipment-template rendering through Copier · opt-in provenance-copy config flag.

🤖 Generated with Claude Code