v3: reworked posting — three panels, drafts, duplicate detection, upload progress

Posting a dump was a single form where the important choices were the easiest
to miss. It is now three panels: link or file, why & where, playlists.

Composition:
- No more URL/File toggle. An empty panel offers both ways in at once and the
  kind follows what you actually did; a file dropped anywhere in the modal is
  accepted, not just on the zone.
- Categories and visibility get their own panel instead of a disclosure that
  read as optional, and the primary button stays "Next" until they've been
  seen. Visibility carries a real label now.
- The draft (link, title, why, categories, visibility) is mirrored to
  localStorage on every change and restored on reopen, so Escape or a stray
  backdrop click costs nothing. Only an attached file can't be restored, so
  that is the one case that asks before closing.
- URL dumps can carry a poster-supplied title instead of being stuck with
  whatever the page scraped, editable right under the preview.
- Multipart uploads go through XHR so there is a real progress bar and a
  percentage on the button, rather than 50 MB of silence.

Duplicates:
- New dumps.url_canonical column (+ index, backfilled by 0013) holding a lossy
  key that ignores scheme, www., trailing slashes, tracking parameters and
  YouTube share shapes. GET /api/dumps/by-url reads it, and the create form
  warns "already dumped by X" while it fetches the preview. Never blocking.

Fixes:
- /api/preview now reports whether the page was actually reached: a failed
  fetch still yields a hostname-only stub, so a dead link and a page without
  metadata used to render identically.
- The Web Share Target never worked. The manifest posts to "/", but the index
  redirect dropped the query string, so every Android share landed on the feed
  with nothing pre-filled.
- File dumps no longer take the extension into their title.
- The link field no longer autofocuses on touch, where it raised a keyboard
  over the modal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TiAPtJZeCYYk8rKehtLUQU

api/services/dump-service.ts

@@ -3,6 +3,7 @@ import {
   APIException,
   type CreateUrlDumpRequest,
   type Dump,
+  type DumpUrlMatch,
   type UpdateDumpRequest,
 } from "../model/interfaces.ts";
 import {
@@ -28,6 +29,7 @@ import {
   notifyUserFollowersNewDump,
 } from "./notification-service.ts";
 import { makeSlug, UUID_RE } from "../lib/slugify.ts";
+import { canonicalizeUrl } from "../lib/canonical-url.ts";
 import {
   DUMP_ALLOWED_MIME_PREFIXES,
   DUMP_ALLOWED_MIME_TYPES,
@@ -63,13 +65,16 @@ export async function createUrlDump(
   const dumpId = crypto.randomUUID();
   const createdAt = new Date();
   const richContent = await fetchRichContent(request.url);
-  const title = richContent?.title ?? titleFromUrl(request.url);
+  // A title typed on the create form wins over the one scraped from the page:
+  // the poster has seen the preview and is correcting it.
+  const title = request.title?.trim() || richContent?.title ||
+    titleFromUrl(request.url);
   const isPrivate = request.isPrivate ?? false;
   const slug = makeSlug(title, dumpId);
 
   db.prepare(
-    `INSERT INTO dumps (id, kind, title, slug, comment, user_id, created_at, url, rich_content, is_private)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?);`,
+    `INSERT INTO dumps (id, kind, title, slug, comment, user_id, created_at, url, url_canonical, rich_content, is_private)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);`,
   ).run(
     dumpId,
     "url",
@@ -79,6 +84,7 @@ export async function createUrlDump(
     userId,
     createdAt.toISOString(),
     request.url,
+    canonicalizeUrl(request.url),
     richContent ? JSON.stringify(richContent) : null,
     isPrivate ? 1 : 0,
   );
@@ -294,6 +300,54 @@ export function listDumps(
   return { items, total: totalRow?.count ?? 0 };
 }
 
+/**
+ * Dumps that already point at the same thing as `url`, newest first.
+ *
+ * Matched on the canonical key rather than the raw URL, so a link reposted with
+ * different tracking parameters, scheme, `www.`, or (for YouTube) in a
+ * different share shape still counts as the same dump. Private dumps are
+ * visible only to their owner, exactly as everywhere else.
+ *
+ * Returns a small display-only projection: this feeds a hint on the create
+ * form, not a feed.
+ */
+export function findDumpsByUrl(
+  url: string,
+  requestingUserId?: string,
+  limit = 3,
+): DumpUrlMatch[] {
+  const canonical = canonicalizeUrl(url);
+  if (!canonical) return [];
+
+  const rows = db.prepare(
+    `SELECT d.id, d.slug, d.title, d.created_at, d.vote_count, u.username,
+       (SELECT COUNT(*) FROM comments WHERE dump_id = d.id AND deleted = 0) as comment_count
+     FROM dumps d
+     JOIN users u ON u.id = d.user_id
+     WHERE d.url_canonical = ? AND (d.is_private = 0 OR d.user_id = ?)
+     ORDER BY d.created_at DESC
+     LIMIT ?;`,
+  ).all(canonical, requestingUserId ?? null, limit) as {
+    id: string;
+    slug: string | null;
+    title: string;
+    created_at: string;
+    vote_count: number;
+    username: string;
+    comment_count: number;
+  }[];
+
+  return rows.map((row) => ({
+    id: row.id,
+    slug: row.slug ?? undefined,
+    title: row.title,
+    username: row.username,
+    createdAt: new Date(row.created_at),
+    voteCount: row.vote_count,
+    commentCount: row.comment_count,
+  }));
+}
+
 export async function updateDump(
   dumpId: string,
   request: UpdateDumpRequest,
@@ -387,12 +441,13 @@ export async function updateDump(
 
   const row = dumpApiToRow(updatedDump);
   const result = db.prepare(
-    `UPDATE dumps SET title = ?, slug = ?, comment = ?, url = ?, rich_content = ?, is_private = ?, updated_at = ? WHERE id = ?;`,
+    `UPDATE dumps SET title = ?, slug = ?, comment = ?, url = ?, url_canonical = ?, rich_content = ?, is_private = ?, updated_at = ? WHERE id = ?;`,
   ).run(
     row.title,
     row.slug,
     row.comment,
     row.url,
+    row.url ? canonicalizeUrl(row.url) : null,
     row.rich_content,
     row.is_private,
     now.toISOString(),