Note the delete order of the file API and graph captions

- API: deleting someone else's file answers 403 before 404, so a
  stranger learns nothing about another folder.
- Tilemaps: graph notes and groups keep their caption while painting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

API.md

@@ -21,7 +21,7 @@ All routes go through `api/index.php?r=…` (the site's nginx does not pass `PAT
 | GET | `releases/{token}` | `{name,publishedAt,project}` — the released copy, **without a session**: the one route besides `auth/*` open to everybody. `project.id` is the token, not the project's id. **404** for an unknown or taken-down token |
 | GET | `textures` | `[{file,name,width,height,bytes,updatedAt,owner,deletable}]` — what the image picker offers: the caller's own files and nobody's, an administrator's every file (see below) |
 | POST | `textures&name=hero.png` | **raw image bytes** → `{file,name,width,height,bytes}` (201), stored in the caller's folder; **422** for bytes that are no readable image |
-| DELETE | `textures/{file}` | 204. `{file}` is the stored name, folder and all. **403** unless it lies in the caller's folder or the caller is an administrator, **409** while a project, snapshot or release of any account uses it |
+| DELETE | `textures/{file}` | 204. `{file}` is the stored name, folder and all. **403** unless it lies in the caller's folder or the caller is an administrator, **404** when there is no such file (asked only after the 403, so a stranger learns nothing of another folder), **409** while a project, snapshot or release of any account uses it |
 | GET | `fonts` | `[{file,name,bytes,updatedAt,owner,deletable}]` — what the font picker offers |
 | POST | `fonts&name=Serif.ttf` | **raw font bytes** → `{file,name,bytes}` (201); **422** for bytes that are no font |
 | DELETE | `fonts/{file}` | 204, **403**, **409** like an image |

Tilemaps.md

@@ -360,6 +360,8 @@ A third round (#347) took out what **painting** cost on top of that:
 - Each frame of a stroke previews the model, and the asset and hierarchy panels built every row
   anew on it. Every label became a new text, and every text a new upload to the GPU. `ListView`
   now keeps a row whose item draws the same (`sameListItem`) and builds only the ones that changed.
+  An open graph tab did the same with the captions of its groups and comments, because each redraw
+  gave them a new style. A caption now keeps its style while colour and width stay.
 - The brush drew the whole scene on every pointer event, on top of the preview and of `animate`.
   Now the preview draws what a stroke changed, once a frame. The rectangle tool asks for one
   drawing a frame for its box. `animate` asks just before the frame is drawn instead of in the