Keep several saves, with migration, atomic writes and import previews (Closes #37)

Savegames now lists independent save slots made with the loaded ROM:
new game, continue, rename, duplicate, export and delete. The native
database moves to IndexedDB version 2; the singleton save becomes
"Save 1" inside the upgrade transaction, so it migrates exactly once and
the old store is left untouched. Each write adds a generation and drops
older ones in one transaction, keeping two records with CRC-32
checksums: a damaged newest record falls back to the previous one.
Slots and records from a newer player are kept and never written.

Imports are checked in a scratch world before anything changes and
previewed with the trainer, progress, saved time, game data version and
the slots of the same trainer; they go into a new save or replace one,
whose previous record stays recoverable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -29,7 +29,7 @@ flowchart LR
 | `src/game/runtime.ts`           | 30 Hz tick scheduling from real time, input routing and presentation updates                    |
 | `src/input`                     | Abstract buttons, multiple sources and browser bindings                                         |
 | `src/app`                       | Runtime-independent load/play/pause/backup lifecycle                                            |
-| `src/storage`                   | Versioned envelope, IndexedDB transactions and ordered writes                                   |
+| `src/storage`                   | Versioned envelope, save slots with atomic generations and checksums, the singleton migration    |
 | `src/ui`, `src/main.ts`         | Accessible game tabs, UI composition and DOM dialogue, no ROM offsets                           |
 | `src/platform`                  | Browser locks, the installable app (service worker, install, storage) and future native adapters |
 | `src/reference`, `src/emulator` | Original-game reference, excluded from the native build                                         |
@@ -39,7 +39,7 @@ flowchart LR
 
 Saves made during an unfinished walk or jump retain its source tile and completed step count, so loading cannot skip a landing event or map transition. Directional mats wait for exit input; doors, stairs and caves force an animated downward step after arrival.
 
-Native and reference sessions use different IndexedDB databases and Web Locks. Imports reject incompatible schemas and invalid positions before changing the world. A failed import restores the prior state. Original cartridge saves and emulator snapshots cannot be used as native saves.
+Native and reference sessions use different IndexedDB databases and Web Locks. The native player keeps save slots (`storage/slots.ts`, `app/slot-session.ts`): each slot keeps its newest two records with checksums, written in one transaction, and loading falls back to the previous record when the newest is damaged. The singleton save of database version 1 becomes the first slot inside the version-2 upgrade. Imports are previewed in a scratch world and reject incompatible schemas and invalid positions before changing the world or any slot. A failed import, switch or new game restores the prior state. Original cartridge saves and emulator snapshots cannot be used as native saves.
 
 `GameWorld` advances in overworld ticks of two video frames, as the original loop does. The runtime converts elapsed time to ticks. Tile events follow `CheckTileEvent`: a completed step checks connections, then warps, then coordinate events for the current scene. Idle ticks run the current scene script. Map entry runs the NEWMAP, TILES and OBJECTS callbacks on a copy first, so an unsupported callback refuses the step instead of entering a half-initialized map. Objects spawn from event flags at map load, and later flag changes leave them in place until `appear`/`disappear` or the next load.