[devlato]

The formats claudius export writes (#46) are now everywhere else too.

• Studio: an export menu in the toolbar, after the stems menu. It lists the presets in two groups, lossless and compressed. Each is a download of the latest render, named after the song. A format this machine cannot write is greyed out and says why on hover: AAC and Apple Lossless without Core Audio or ffmpeg. The menu says when the render predates the latest change. It works in the native and the web studio; the demo, which has no server, shows no menu.
• MCP: an export tool, with formats and an optional path. It writes into the song's folder (or path), rendering first when the song changed since its last render.
• API:
  • Command::Export writes from the latest render when it is of the song as it is now, and otherwise says to render first.
  • GET /api/export/{version}/{name}.{ext}?format=SPEC serves that render as a download (Content-Disposition: attachment), with the format's media type. It is encoded on request, and the latest export is kept in memory for a second click.

CodeQL flagged the first version of the download (9 rust/path-injection alerts). The version came from Path<(u64, String)>, and the format named a cache file. Neither could leave the cache, but the route now parses the version from a string, as /api/audio does, and keeps nothing on disk. No path is built from the request except the render's number.

• State.exports lists every preset, with its label and why it cannot be written here, when it cannot.

Docs: the Exporting page gains the studio, the tool and the API. Also updated: the MCP tool table, the HTTP routes and commands, the studio page, and the skill's tool list and saving section.

How I checked:

• A new server test: a rendered song exports by command (two formats into a folder; a bad spec is refused) and as a download. The download is checked for type, filename and a decodable 44.1 kHz FLAC, plus a 400 for a mismatched extension and a 404 for a render that isn't there.
• MCP: the test checks that save and export are listed.
• The native studio, driven by CLAUDIUS_UI_PLAN: it rendered a song, and the export menu was opened and captured with all thirteen presets.
• cargo xtask ci passes, and cargo xtask site builds the web studio, with lychee reporting 0 broken links.