feat: revision-check the upsert, MCP and admin writes

- POST /materials locks the matched row and answers 409 to a stale
  revision when it updates; a create ignores revision
- bm_manage_save_material and bm_manage_update_material take revision
- /bmadmin saves bump the revision on content changes (not checked)
- document revisions and the 409 in the README

controllers/materials_hooks.go

@@ -3,6 +3,7 @@ package controllers
 import (
 	"context"
 	"errors"
+	"sync"
 	"sync/atomic"
 
 	"git.golem15.com/golem15/summercms/modules/cabana"
@@ -12,11 +13,18 @@ import (
 )
 
 var (
-	_ pact.FormAfterCreate = materialsAdmin{}
-	_ pact.FormAfterUpdate = materialsAdmin{}
-	_ pact.FormAfterDelete = materialsAdmin{}
+	_ pact.FormBeforeUpdate = materialsAdmin{}
+	_ pact.FormAfterCreate  = materialsAdmin{}
+	_ pact.FormAfterUpdate  = materialsAdmin{}
+	_ pact.FormAfterDelete  = materialsAdmin{}
 )
 
+// pendingRevisions holds, per material id, the content fingerprint
+// (models.MaterialContent) FormBeforeUpdate took before an admin save, for
+// FormAfterUpdate to compare. The row lock FormBeforeUpdate takes keeps one
+// pending save per id at a time.
+var pendingRevisions sync.Map
+
 // MaterialIndex keeps the materials search index current once a write
 // commits (classes.MaterialIndexer). QueueExtract enqueues the file text job
 // inside tx. Its calls never fail the write.
@@ -49,11 +57,56 @@ func (materialsAdmin) FormAfterCreate(ctx context.Context, model any) error {
 	return materialAfterCommit(ctx, model, false)
 }
 
-// FormAfterUpdate queues the file text job in the save transaction and
-// syncs the material once it commits. A save that added no file queues a
-// job that finds no new PDF and only resyncs; a file removed in the form
-// leaves the document through the cascade and this sync.
+// FormBeforeUpdate runs the embedded date check, then, inside the save
+// transaction, locks the material's row and snapshots its content for
+// FormAfterUpdate. An admin save is not revision-checked (the form sends no
+// revision); it only bumps the revision when the content changed, so a later
+// push holding an older revision is refused instead of overwriting the
+// admin edit. Outside a write (no transaction) it does nothing more.
+func (c materialsAdmin) FormBeforeUpdate(ctx context.Context, model any) error {
+	if err := c.temporalHooks.FormBeforeUpdate(ctx, model); err != nil {
+		return err
+	}
+	m, ok := model.(*models.Material)
+	if !ok || m == nil {
+		return errors.New("materials admin: form model is not a material")
+	}
+	tx, ok := cabana.TxFromContext(ctx)
+	if !ok || m.ID == 0 {
+		return nil
+	}
+	var locked int
+	if err := tx.Session(&gorm.Session{NewDB: true}).Raw("SELECT 1 FROM jz_bm_materials WHERE id = ? FOR UPDATE", m.ID).Scan(&locked).Error; err != nil {
+		return err
+	}
+	before, err := models.MaterialContent(tx, m.ID)
+	if err != nil {
+		return err
+	}
+	pendingRevisions.Store(m.ID, before)
+	return nil
+}
+
+// FormAfterUpdate bumps the revision when the save changed the material's
+// content, then queues the file text job in the save transaction and syncs
+// the material once it commits. The compare runs here, not in
+// FormBeforeUpdate, because the course, the zjazd and the tags are final
+// only after the row write and the pivot sync. A revise error fails the save
+// like any database error. A save that added no file queues a job that finds
+// no new PDF and only resyncs; a file removed in the form leaves the
+// document through the cascade and this sync.
 func (materialsAdmin) FormAfterUpdate(ctx context.Context, model any) error {
+	m, ok := model.(*models.Material)
+	if !ok || m == nil {
+		return errors.New("materials admin: form model is not a material")
+	}
+	if pending, found := pendingRevisions.LoadAndDelete(m.ID); found {
+		if tx, ok := cabana.TxFromContext(ctx); ok {
+			if _, _, err := models.ReviseMaterial(tx, m.ID, pending.(string)); err != nil {
+				return err
+			}
+		}
+	}
 	return materialAfterCommit(ctx, model, false)
 }