Extend story publish to include sessions

[TerkaSlan]

Description

The goal of this change is to support the public share of sessions in addition to stories. Sessions shared with stories now get their public session URL that one can share + copy-paste into https://molstar.org/mol-view-stories/builder.

Solution

• in addition to mvsj|mvsx data + metadata, /story now expects a "session" (mvstory) component
  • these are required as FormData (replaced suboptimal base64 for mvsx)
• public access endpoint for story-sessions: /api/story/{id}/session-data
  • on GET, a .mvstories binary file is downloaded
• added loadSessionFromUrl in addition to loadSession (from session id)
  • this prepares /builder to accept public sessions which are potentially hosted anywhere with CORS enabled (not necessarily on the storage tied to our backend)
• adjusted the modal to contain info about the published story and session:

Backward Compatibility

• stories published in the old format still work for READ and UPDATE, in case of UPDATE they're converted to the new format (i.e., with sessions)
• new stories are only created in the new format

Testing

• Added 6 new tests for the functionality
• All scenarios (mvsj, mvsx, happy path, update old format, read old format) tested on local deployment
• loadSessionFromUrl won't work as hardcoded to https://molstar.org/mol-view-stories/builder unless we merge + deploy these changes:

https://molstar.org/mol-view-stories/builder/?session-url=<public url>)

but:
http://localhost:3000/builder/?session-url=http%3A%2F%2Flocalhost%3A5000%2Fapi%2Fstory%2F95e233ca%2Fsession-data works

Actions

• Added description of changes to the [Unreleased] section of CHANGELOG.md

[dsehnal]

Suggested change

	async function saveStoryWithFormData(
	async function saveStory(

[dsehnal]

Suggested change

	const sessionId = searchParams.get('sessionId');
	const sessionUrl = searchParams.get('sessionUrl');
	const templateName = searchParams.get('template');
	const sessionType = searchParams.get('type') as 'session' | 'story' | null;
	const sessionId = searchParams.get('session-id'); // please rename this across the app. The - version looks nicer
	const publishedSessionId = searchParams.get('published-session-id');
	const sessionUrl = searchParams.get('session-url'); // we could allow loading from any hosted session with CORS
	const templateName = searchParams.get('template');

[dsehnal]

Suggested change

	if (sessionUrl) {
	loadSessionFromUrl(sessionUrl);
	return;
	}
	const url = sessionUrl ?? resolvePublishedSessionUrl(publishedSessionId );
	if (url) {
	loadSessionFromUrl(url);
	// TODO: clear session-url and published-session-i
	return;
	}

[dsehnal]

Suggested change

	if (sessionType) {
	try {
	const url = new URL(window.location.href);
	url.searchParams.delete('type');
	window.history.replaceState({}, '', url.toString());
	} catch (error) {
	console.warn('Failed to clear type param:', error);
	}
	}

[dsehnal]

LGTM, feel free to merge when ready