[erickkkyt]

Fixes #29. Large Canvas projects now support persistent named/collapsible groups, content/group arrangement, logical Asset folders, exact-version Elements, and reusable local workflow templates. UI and MCP use the same revision-checked atomic commands; template insertion creates inspectable drafts without generation or upload. Eight added tools bring the source catalog to 38.

Adapted from JaysonAlbert/BeatDesign draft PR #16, organization commits e4ae849 and 2176e20, with contributor credit. The integration preserves BeatAPI and existing project/Asset/Timeline boundaries. Fork-only providers and Series/Scenes changes are outside this PR.

Upstream integration fixes include generic text-card persistence/rendering, readiness gating before first template insertion, digest verification across viewport autosaves, and expanding/focusing inserted drafts. The local runtime now enforces local Host authorities and loopback startup. Packaged schema migration and its receipt commit atomically while tolerating additive upgrades already performed by older runtimes.

Validation:

• pnpm build, pnpm typecheck, pnpm test (505 passed; no skips), pnpm i18n:check.
• 25 production browser/MCP checks: English/Chinese groups, folders, version review, templates, mobile focus/retained input, exact Timeline Assets, insertion visibility and Host rejection.
• Separate pure compatibility review of all 26 official model descriptors; zero provider requests.
• Clean tarball installation, 38-tool stdio handshake and production route smoke checks; WorkBuddy Connector structure validation.
• Migration regression covers existing data, previously added columns, repeat setup and failure rollback. Dedicated command clients close explicitly after commit/rollback, isolate uncommitted reads and avoid native handles retained until GC; settings/configuration use the same boundary.
• Remove the unused shadcn generator CLI and 231 indirect packages, clearing all 71 development-tree advisories. Full dependency audit now has zero advisories; CI checks development and production dependencies. Worktree/staged security scanners and manual diff review passed.

README, product status, MCP, host Skills and release-scope documentation distinguish current source from the published v0.2.5 packages. No new release/package publication or credentialed/paid generation is claimed.