refactor and limits change

backend/main.py

@@ -626,7 +626,7 @@ async def get_media(media_path: str):
 
 
 @api_router.put("/media/{media_path:path}", tags=["Media"])
-@limiter.limit("30/minute")
+@limiter.limit("120/minute")
 async def put_media(media_path: str, request: Request):
     """
     Overwrite an existing media file in place (used for saving drawing PNGs).
@@ -662,6 +662,10 @@ async def put_media(media_path: str, request: Request):
                 detail=f"File too large. Maximum size: {UPLOAD_MAX_IMAGE_MB}MB",
             )
 
+        # Reject non-PNG payloads (defense in depth; path already restricts to .png)
+        if len(body) < 8 or body[:8] != b"\x89PNG\r\n\x1a\n":
+            raise HTTPException(status_code=400, detail="Body must be a valid PNG image")
+
         try:
             with open(full_path, 'wb') as f:
                 f.write(body)

frontend/app.js

@@ -508,6 +508,10 @@ function noteApp() {
         drawingIsPointerDown: false,
         /** True after the PNG from disk has been decoded into _drawingBaseImage; false after Clear. */
         drawingHasRasterFromFile: false,
+        /** Prevents overlapping drawingSave() runs (Ctrl+S + autosave + fast retries). */
+        _drawingSaveInFlight: false,
+        /** If true, run drawingSave again after the current one finishes (coalesce). */
+        _drawingSaveQueued: false,
         _drawingAutosaveTimeout: null,
         
         // DOM element cache (to avoid repeated querySelector calls)
@@ -3268,6 +3272,12 @@ function noteApp() {
          */
         async drawingSave() {
             if (!this.currentMedia || this.currentMediaType !== 'drawing') return;
+            if (this._drawingSaveInFlight) {
+                this._drawingSaveQueued = true;
+                return;
+            }
+            this._drawingSaveInFlight = true;
+            try {
                 this._drawingCancelAutosave();
                 const canvas = this._drawingCanvasEl;
                 const ctx = this._drawingCtx;
@@ -3306,6 +3316,17 @@ function noteApp() {
                 } finally {
                     this.isSaving = false;
                 }
+            } finally {
+                this._drawingSaveInFlight = false;
+                if (this._drawingSaveQueued) {
+                    this._drawingSaveQueued = false;
+                    queueMicrotask(() => {
+                        if (this.currentMedia && this.currentMediaType === 'drawing') {
+                            this.drawingSave();
+                        }
+                    });
+                }
+            }
         },
         
         // Handle clicks on internal links in preview