upgrade: adopt V8.32.0-dev.1 (theme preview iframe fix, editor simple mode)

Overlay 46 upstream items; full patch set re-applied (all patched files
reset by overlay regardless of upstream change status — lesson recorded).
Verified: theme suites 35/35; dual-baseline 418 passed vs pristine
389+29 ours, FAILED-set diff EMPTY (same 10 Windows env fails).
Live: container 8.32.0-dev.1 healthy, hesupipe 192 entries intact,
trade-pro build 203 pages 0 errors.

Co-Authored-By: Claude Code <noreply@anthropic.com>

tests/test_theme_pro_v3.py

@@ -31,7 +31,7 @@ def test_four_complete_theme_families_have_distinct_markup(factory):
         import re as _re
         m=_re.search(r'class="((?:pro-home-hero|sf-tp-hero)[^"]*)"',html)
         return m.group(1) if m else html[:40]
-    assert len(set(_hero_sig(s) for s in main))==5  # 5 themes, 5 distinct hero signatures (was 4 before trade-pro)
+    assert len(set(_hero_sig(s) for s in main))==5
 
 
 def test_theme_build_derived_category_brand_search_and_seo(factory):

tests/test_v832_preview_easy_editor.py

@@ -0,0 +1,46 @@
+"""V8.32 regression: authenticated inline preview stays same-origin and other routes stay denied."""
+from test_factory_v2 import factory,site
+
+
+def test_theme_preview_is_frameable_only_on_same_origin(factory):
+    for theme in ('automotive','industrial','corporate','minimal'):
+        for page in ('home','listing','product','article','about','contact'):
+            result=factory.get(f'/api/factory/themes/{theme}/preview',params={'page_type':page})
+            assert result.status_code==200,(theme,page,result.text[:120])
+            assert result.headers['x-frame-options']=='SAMEORIGIN'
+            assert result.headers['content-security-policy']=="frame-ancestors 'self'"
+            assert result.headers['cache-control']=='no-store'
+            assert 'text/html' in result.headers['content-type']
+    assert factory.get('/theme-gallery').headers['x-frame-options']=='DENY'
+    assert factory.get('/operations').headers['x-frame-options']=='DENY'
+    assert factory.get('/api/factory/themes/automotive/preview.css').headers['x-frame-options']=='DENY'
+
+
+def test_preview_requires_login_and_other_protections_remain(factory):
+    from tests.legacy import LegacyTestClient as Client
+    from app.main import app
+    with Client(app) as unauth:
+        result=unauth.get('/api/factory/themes/automotive/preview')
+        assert result.status_code==401
+    assert factory.get('/api/factory/themes/automotive/preview?page_type=invalid').status_code==400
+
+
+def test_gallery_and_studio_show_useful_fallback_and_easy_buttons(factory):
+    gallery=factory.get('/theme-gallery').text
+    assert 'previewStatus' in gallery and 'retryPreview' in gallery and 'openPreview' in gallery
+    assert 'requestedTheme' in gallery and 'response.ok' in gallery
+    sid=site(factory)
+    pages=factory.get(f'/api/sites/{sid}/entries').json()
+    entry=pages[0]['id']
+    html=factory.get(f'/editor/{sid}/{entry}').text
+    assert 'studioAdvancedButton' in html
+    assert 'sfNextAction' in html and 'sfCloseInspector' in html
+    assert 'sandbox="allow-scripts"' in html and 'allow-same-origin' not in html
+    js=factory.get('/ui/editor.js').text
+    assert 'toggleAdvanced(){' in js
+    assert "response.ok" in js and 'themePreviewSeq' in js
+    assert '从图片素材库选择' in js and '上传新图片' in js
+    css=factory.get('/ui/editor.css').text
+    assert 'body:not(.sf-advanced-mode) #tabStyle' in css
+    workspace=factory.get('/ui/workspace.js').text
+    assert '预览页面效果' in workspace and '/theme-gallery?theme=' in workspace