feat: pool set_mask + route

Write a per-slot grayscale mask sidecar (img_XXXX.mask.png) and record
it on the slot. Add the multipart /grid_pool/set_mask route.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_pool.py

@@ -119,3 +119,15 @@ def test_read_corrupt_manifest_triggers_rebuild(tmp_path):
     (d / "manifest.json").write_text("{ not json")
     m = pool.read_manifest(str(tmp_path), "p1")
     assert [s["image"] for s in m["slots"]] == ["img_0001.png"]
+
+
+def test_set_mask_writes_sidecar(tmp_path):
+    pool.add_image(str(tmp_path), "p1", b"a", ts=1)
+    m = pool.set_mask(str(tmp_path), "p1", 0, b"MASKBYTES")
+    assert m["slots"][0]["mask"] == "img_0001.mask.png"
+    assert (tmp_path / "p1" / "img_0001.mask.png").read_bytes() == b"MASKBYTES"
+
+
+def test_set_mask_out_of_range_noop(tmp_path):
+    m = pool.set_mask(str(tmp_path), "p1", 0, b"x")
+    assert m["slots"] == []

tests/test_routes_logic.py

@@ -21,3 +21,11 @@ def test_handle_active_label_remove(tmp_path):
     assert handlers.handle_active(base, "p1", 1)["active"] == 1
     assert handlers.handle_label(base, "p1", 0, "hi")["slots"][0]["label"] == "hi"
     assert len(handlers.handle_remove(base, "p1", 0)["slots"]) == 1
+
+
+def test_handle_set_mask(tmp_path):
+    base = str(tmp_path)
+    handlers.handle_add(base, "p1", _png_bytes(), "png", ts=1)
+    m = handlers.handle_set_mask(base, "p1", 0, b"MASKBYTES")
+    assert m["slots"][0]["mask"] == "img_0001.mask.png"
+    assert (tmp_path / "p1" / "img_0001.mask.png").read_bytes() == b"MASKBYTES"